----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

Join the FREE BETA test of the Network Software Inspector (NSI)!
http://secunia.com/network_software_inspector/

The NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
HP Systems Insight Manager Session Fixation Vulnerability

SECUNIA ADVISORY ID:
SA25275

VERIFY ADVISORY:
http://secunia.com/advisories/25275/

CRITICAL:
Less critical

IMPACT:
Hijacking

WHERE:
>From remote

SOFTWARE:
HP Systems Insight Manager 4.x
http://secunia.com/product/394/
HP Systems Insight Manager 5.x
http://secunia.com/product/656/

DESCRIPTION:
Luka Treiber and Aljosa Ocepek have reported a vulnerability in HP
Systems Insight Manager, which can be exploited by malicious people
to conduct session fixation attacks.

The vulnerability is caused due to an error in the handling of
sessions and can be exploited to hijack another user's session by
tricking the user into logging in after following a specially crafted
link.

The vulnerability affects the following versions:
* HP SIM 4.2
* HP SIM 5.0 SP4
* HP SIM 5.0 SP5

SOLUTION:
Update to HP SIM 5.1 with SP1.
http://h18013.www1.hp.com/products/servers/management/hpsim/dl_windows.html#windows

PROVIDED AND/OR DISCOVERED BY:
Luka Treiber and Aljosa Ocepek, ACROS Security

ORIGINAL ADVISORY:
HPSBMA02213 SSRT061214:
https://www4.itrc.hp.com/service/cki/docDisplay.do?admit=-682735245+1179237253410+28353475&docId=c01049713

ACROS Security:
http://www.acrossecurity.com/aspr/ASPR-2007-05-14-1-PUB.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------