KM03518316 - Service Manager vulnerabilities - CVE-2019-11661, CVE-2019-11662, CVE-2019-11663, CVE-2019-11664, CVE-2019-11665, CVE-2019-11666, CVE-2018-0732, CVE-2018-0737.

Document ID:KM03518316
Creation Date:09-Sep-2019
Modified Date:18-Oct-2019
- Micro Focus Products:
  service manager 9.30
  
  service manager 9.31
  
  service manager 9.32
  
  service manager 9.33
  
  service manager 9.34
  
  service manager 9.35
  
  service manager 9.40
  
  service manager 9.41
  
  service manager 9.50
  
  service manager 9.51
  
  service manager 9.52
  
  service manager 9.60
  
  service manager 9.61
  
  service manager 9.62

Summary

Potential vulnerabilities have been identified in Service Manager: * Can be exploited to allow unauthorized access and modification of data. * Can be exploited in some special cases to allow information exposure through an error message. * Can be exploited to allow sensitive data exposure. * The vulnerability could be exploited to allow a denial of service and sensitive data exposure. * The vulnerability could be exploited to allow insecure deserialization of untrusted data.

Reference

SUPPORT COMMUNICATION - SECURITY BULLETIN

Potential Security Impact: <Remote Vulnerability>

VULNERABILITY SUMMARY

A potential vulnerability has been identified in Service Manager. The vulnerability could be exploited to allow unauthorized access and modification of data.

CVE References: CVE-2019-11661

CVSS Version 3.0 and Version 2.0 Base Metrics

Reference	V3 Vector	V3 Base Score	V2 Vector	V2 Base Score
CVE-2019-11661	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L	6.7	(AV:N/AC:M/Au:N/C:C/I:C/A:C)	X.X

RESOLUTION:

Micro Focus has made the following mitigation information available to resolve the vulnerability for the impacted versions of Service Manager:

For all versions we recommend to:

Upgrade to the latest Service Manager 9.63

Package (Applications):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01023

SUPPORT COMMUNICATION - SECURITY BULLETIN

Potential Security Impact: <Remote Vulnerability>

VULNERABILITY SUMMARY

A potential vulnerability has been identified in Service Manager. The vulnerability could be exploited in some special cases to allow information exposure through an error message.

CVE References: CVE-2019-11662

CVSS Version 3.0 and Version 2.0 Base Metrics

Reference	V3 Vector	V3 Base Score	V2 Vector	V2 Base Score
CVE-2019-11662	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N	2.6	(AV:N/AC:M/Au:N/C:C/I:C/A:C)	X.X

RESOLUTION:

Micro Focus has made the following mitigation information available to resolve the vulnerability for the impacted versions of Service Manager:

For all versions we recommend to:

Upgrade to the latest Service Manager 9.63

Package (Server for Windows):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01013

Package (Server for Linux):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01014

SUPPORT COMMUNICATION - SECURITY BULLETIN

Potential Security Impact: <Remote Vulnerability>

VULNERABILITY SUMMARY

A vulnerability in a third-party embedded component was addressed by Service Manager. The vulnerability could be exploited to allow sensitive data exposure.

CVE References: CVE-2019-11663

CVSS Version 3.0 and Version 2.0 Base Metrics

Reference	V3 Vector	V3 Base Score	V2 Vector	V2 Base Score
CVE-2019-11663	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L	6.7	(AV:N/AC:M/Au:N/C:C/I:C/A:C)	X.X

RESOLUTION:

Micro Focus has made the following mitigation information available to resolve the vulnerability for the impacted versions of Service Manager:

For all versions we recommend to:

Upgrade to the latest SM 9.63

Package (Knowledge Management):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01024

Or you can upgrade to the latest patch of your specific version.

For version 9.30 - 9.35 please:

Upgrade to SM 9.35.P7 and above

Package (Knowledge Management):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01012

For version 9.40, 9.41 please:

Upgrade to SM 9.41.P8 and above

Package (Knowledge Management):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00997

For version 9.50 – 9.52 please:

Upgrade to SM 9.52.P5 and above

Package (Knowledge Management):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00987

For version 9.60 – 9.62 please:

Upgrade to SM 9.63 and above

Package (Knowledge Management):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01012

SUPPORT COMMUNICATION - SECURITY BULLETIN

Potential Security Impact: <Local Vulnerability>

VULNERABILITY SUMMARY

A potential vulnerability has been identified in Service Manager. The vulnerability could be exploited to allow sensitive data exposure.

CVE References: CVE-2019-11664

CVSS Version 3.0 and Version 2.0 Base Metrics

Reference	V3 Vector	V3 Base Score	V2 Vector	V2 Base Score
CVE-2019-11664	CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L	5.6	(AV:N/AC:M/Au:N/C:C/I:C/A:C)	X.X

RESOLUTION:

Micro Focus has made the following mitigation information available to resolve the vulnerability for the impacted versions of Service Manager:

For all versions we recommend to:

Upgrade to the latest Service Manager 9.63

Package (Web Tier):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01015

Or you can upgrade to the latest patch of your specific version.

For version 9.30 - 9.35 please:

Upgrade to SM 9.35.P7 and above

Package (Web Tier):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01010

For version 9.40, 9.41 please:

Upgrade to SM 9.41.P8 and above

Package (Web Tier):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00994

For version 9.50 – 9.52 please:

Upgrade to SM 9.52.P5 and above

Package (Web Tier):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00983

For version 9.60 – 9.62 please:

Upgrade to the latest Service Manager 9.63

Package (Web Tier):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01015

SUPPORT COMMUNICATION - SECURITY BULLETIN

Potential Security Impact: <Remote Vulnerability>

VULNERABILITY SUMMARY

A vulnerability in an embedded third-party component was addressed by Service Manager. The vulnerability could be exploited to allow a denial of service and sensitive data exposure.

CVE References: CVE-2018-0732 and CVE-2018-0737

CVSS Version 3.0 and Version 2.0 Base Metrics

Reference	V3 Vector	V3 Base Score	V2 Vector	V2 Base Score
CVE-2018-0732	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	7.5	(AV:N/AC:L/Au:N/C:N/I:N/A:P)	5.0
CVE-2018-0737	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	5.9	(AV:N/AC:M/Au:N/C:P/I:N/A:N)	4.3

RESOLUTION:

Micro Focus has made the following mitigation information available to resolve the vulnerability for the impacted versions of Service Manager:

For all versions we recommend to:

Upgrade to the latest Service Manager 9.63

Package (Server for Windows):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01013

Package (Server for Linux):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01014

Or you can upgrade to the latest patch of your specific version.

For version 9.30 - 9.35 please:

Upgrade to SM 9.35.P7 and above

Package (Server for AIX):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01004

Package (Server for HP Itanium):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01005

Package (Server for HP Itanium Server for Oracle 12c):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01006

Package (Server for Linux):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01007

Package (Server for Solaris):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01008

Package (Server for Windows):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01009

For version 9.40, 9.41 please:

Upgrade to SM 9.41.P8 and above

Package (Server for AIX):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00989

Package (Server for HP-UX/IA):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00990

Package (Server for Linux):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00991

Package (Server for Solaris):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00992

Package (Server for Windows):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00993

For version 9.50 – 9.52 please:

Upgrade to SM 9.52.P5 and above

Package (Server for Windows):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00981

Package (Server for Linux):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_00982

For version 9.60 – 9.62 please:

Upgrade to SM 9.63 and above

Package (Server for Windows):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01013

Package (Server for Linux):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01014

SUPPORT COMMUNICATION - SECURITY BULLETIN

Potential Security Impact: <Remote Vulnerability>

VULNERABILITY SUMMARY

A potential vulnerability has been identified in Service Manager. The vulnerability could be exploited to allow sensitive data exposure.

CVE References: CVE-2019-11665

CVSS Version 3.0 and Version 2.0 Base Metrics

Reference	V3 Vector	V3 Base Score	V2 Vector	V2 Base Score
CVE-2019-11665	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L	6.7	(AV:N/AC:M/Au:N/C:C/I:C/A:C)	X.X

RESOLUTION:

Micro Focus has made the following mitigation information available to resolve the vulnerability for the impacted versions of Service Manager:

For all versions we recommend to:

Upgrade to the latest Service Manager 9.63

Package (Server for Windows):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01013

Package (Server for Linux):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01014

SUPPORT COMMUNICATION - SECURITY BULLETIN

Potential Security Impact: <Remote Vulnerability>

VULNERABILITY SUMMARY

A vulnerability in an emdedded third-party component was addressed by Service Manager. The vulnerability could be exploited to allow insecure deserialization of untrusted data.

CVE References: CVE-2019-11666

CVSS Version 3.0 and Version 2.0 Base Metrics

Reference	V3 Vector	V3 Base Score	V2 Vector	V2 Base Score
CVE-2019-11666	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N	3.7	(AV:N/AC:M/Au:N/C:C/I:C/A:C)	X.X

RESOLUTION:

Micro Focus has made the following mitigation information available to resolve the vulnerability for the impacted versions of Service Manager:

For all versions we recommend to:

Upgrade to the latest Service Manager 9.63

Package (Service Request Catalog):

https://support.microfocus.com/kb/kmdoc.php?id=group/softwaresupport/search-result/-/facetsearch/document/LID/HPSM_01017

For all vulnerabilities above note the following:

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

Service Manager: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62