Secunia

A vulnerability has been reported in various HP StorageWorks products, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the RMI (Remote Management Interface) when handling cookies. This can be exploited to gain administrative interface privileges by setting the "RMU_LEVEL" cookie to 2.

The vulnerability is reported in the following versions:
* HP StorageWorks 1/8 G2 Tape Autoloader firmware version 2.30 and earlier
* HP StorageWorks MSL2024 Tape Library firmware version 4.20 and earlier
* HP StorageWorks MSL4048 Tape Library firmware version 6.50 and earlier
* HP StorageWorks MSL8096 Tape Library firmware version 8.90 and earlier

Solution
Update to a fixed version.
Further details available in Customer Area

Provided and/or discovered by
Alexander Polyakov, Digital Security Research Group

Changelog
Further details available in Customer Area

Original Advisory
HPSBST02459 SSRT080134:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01868405

Digital Security Research Group:
http://dsecrg.com/pages/vul/show.php?id=111

Deep Links
Links available in Customer Area