HP has acknowledged a weakness and two vulnerabilities in HP System Management Homepage, which can be exploited by malicious people to conduct cross-site scripting and spoofing attacks.

1) A weakness in PHP can potentially be exploited to conduct cross-site scripting attacks when "display_errors" is enabled.

2) A vulnerability in OpenSSL can be exploited by malicious people to conduct spoofing attacks

For more information:
SA33338

3) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities and the weakness are reported in HP System Management Homepage (SMH) prior to version 3.0.1.73 running on Linux, and Windows 2003 and 2008.

Solution
Update to version 3.0.1.73.
Further details available in Customer Area

Provided and/or discovered by
3) The vendor credits Masashi Shiraishi.

Changelog
Further details available in Customer Area

Original Advisory
HPSBMA02426 SSRT090053:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01743291

HPSBMA02428 SSRT090048:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01745065

JVN#02331156:
http://jvn.jp/en/jp/JVN02331156/index.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area