HP perfomance monitor can climb through Windows

Rapid7 is advising HP SiteScope users to run the tool on Linux rather than Windows servers because of a nasty privilege escalation vulnerability. The agentless monitoring environment that headlines HP's operational management offerings lets authenticated users run commands with system privilege, the security bods explain. The …

[Anonymous Coward]

HP+Security makes me laugh.

I've seen many security problems in HP products. "HP Storage ESL" comes to mind it has by default a web server running, no login required that allows reboots.

[a_yank_lurker]

Again?

It sounds like the real solution is to run a script during installation to reset the parameters to a more safe instance. Since it does not need root privileges in Linux is there a good reason why admin privileges are needed in Windows?

[david 12]

Re: Again?

"SYSTEM" is not an account. It is a SID, a role, an account type. And that SID, by itself, doesn't work for most network tasks, so whatever account they are using must also include a SID that does have network privileges.

There probably is a good reason why it needs a privilege in Windows which doesn't exist in Linux. It could be anything, and it might not even be a privilege associated with the SYSTEM role: it might be a privilege associated with the other role.

[Mikel]

Always good advice

Heed it with everything else too.

[Anonymous Coward]

Please tell me they don't use a shell to perform a DNS query...

... but from what I see it looks again sloppy developers took a dangerous shortcut.

[anonymous boring coward]

Would it be too much to ask that SiteScope was fixed?

[Fatman]

Wishful thinking

<quote>Would it be too much to ask that SiteScope was fixed?</quote>

No, because the "fix budget" was blown by the Autonomy purchase.