Dave Aitel has discovered a vulnerability in HP HTTP server, allowing malicious people to gain access to administrative functions.

The problem is that if HP HTTP has been configured to accept "Anonymous Access", it is possible to upload a client certificate, which will be accepted as a valid certificate for authorisation. This can be exploited by malicious people to gain access to administrative functions.

The vulnerability affects all HP Web Based Management Products running HP HTTP versions 5.0 through 5.92.

Solution
Update to version 5.93.
Further details available to Secunia VIM customers

Provided and/or discovered by
Dave Aitel of Immunity Research

Original Advisory
Immunity:
http://www.immunitysec.com/downloads/hp_http.sxw.pdf

HP:
http://h18023.www1.hp.com/support/files/Server/us/download/20197.html

Deep Links
Links available to Secunia VIM customers