HP has acknowledged a weakness and a vulnerability in HP Systems Insight Manager, which can be exploited by malicious people to disclose system information and potentially to bypass certain security restrictions.

1) A weakness in JBoss can be exploited to disclose system information.

For more information:
SA15746

The weakness has been reported in versions 5.0, 5.0 SP1, 5.0 SP2, and 5.0 SP3. Only the Windows platform is affected.

2) An unspecified vulnerability can potentially be exploited to gain access to arbitrary files via directory traversal attacks.

The vulnerability has been reported in versions 4.2, 4.2 SP1, 4.2 SP2, 5.0, 5.0 SP1, 5.0 SP2, and 5.0 SP3. Only the Windows platform is affected.

Solution
Update to version 5.0 SP4.
Further details available to Secunia VIM customers

Provided and/or discovered by
Matthew Cook and Paul Whitton

Changelog
Further details available to Secunia VIM customers

Original Advisory
HPSBMA02096 SSRT061108:
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00597967

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers