HP has acknowledged a weakness and a vulnerability in HP Systems Insight Manager, which can be exploited by malicious people to disclose system information and potentially to bypass certain security restrictions.

1) A weakness in JBoss can be exploited to disclose system information.

For more information:
SA15746

The weakness has been reported in versions 5.0, 5.0 SP1, 5.0 SP2, and 5.0 SP3. Only the Windows platform is affected.

2) An unspecified vulnerability can potentially be exploited to gain access to arbitrary files via directory traversal attacks.

The vulnerability has been reported in versions 4.2, 4.2 SP1, 4.2 SP2, 5.0, 5.0 SP1, 5.0 SP2, and 5.0 SP3. Only the Windows platform is affected.

Solution
Update to version 5.0 SP4.
Further details available in Customer Area

Provided and/or discovered by
Matthew Cook and Paul Whitton

Changelog
Further details available in Customer Area

Original Advisory
HPSBMA02096 SSRT061108:
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00597967

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area