HPE warns of a critical zero-day flaw in server management software

There's a workaround for Windows customers, but nothing for Linux admins

HPE building with sign

HPE has announced a critical zero-day vulnerability in a key server management application that renders its Windows and Linux servers vulnerable to attack.

Trend Micro discovered the vulnerability, which has the ID CVE-2020-7200 in the MITRE vulnerability database. The vulnerability lies in HP's Systems Insight Manager (SIM), an application that allows administrators to check a server's health.

The bug has a base score of 9.8 in the CVSS v3 vulnerability scoring system, which measures a security flaw's severity on a scale of 1 to 10, putting it in the critical category. An attacker could exploit the problem to execute remote code on a Windows or Linux server, according to HPE’s security advisory issued this week.

As a zero-day bug, there’s no patch for this vulnerability, and HPE hasn't said when one will be available. Instead, HPE promises it in "a future release." In the meantime, HPE has issued a workaround for Windows systems.

Administrators must stop the HPE SIM service and delete a file named “simsearch.war” from the Java-based system. This removes the federated search capability that contains the flaw, making it unusable.

SIM manages hardware across an array of HPE servers, including its ProLiant and Integrity systems, along with storage and networking products. The system discovers devices in the host infrastructure and offers inventory management and reporting for them. It lets administrators monitor health without using software agents and configure policies to execute scripts and notify people of failures.

HP launched the federated search feature in 2011, allowing administrators to search the SIM Central Management Server (CMS) for things like static inventory data and installed software. Without this service, HP documents explain that companies with multiple CMS systems will have a fragmented view of company-wide inventory. 

"When large enterprises have CMSes spread across multiple geographic locations, this limitation becomes even more acute," HP’s product documents say.

This workaround only works for Windows servers. There doesn't appear to be an immediate plan for Linux server users.

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

Lenovo and VMware collaborate on resilient edge computing
Network & Internet

Lenovo and VMware collaborate on resilient edge computing

7 Sep 2021
HPE inks $2 billion high-performance computing deal with the NSA
high-performance computing (HPC)

HPE inks $2 billion high-performance computing deal with the NSA

1 Sep 2021
7 most powerful computers of all time
Hardware

7 most powerful computers of all time

26 Aug 2021
New malware plants backdoor on Microsoft web server software
cyber security

New malware plants backdoor on Microsoft web server software

9 Aug 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021