Print | Rate this content

HPSBMA02323 SSRT080032 rev.1 - HP USB Floppy Drive Key (Option) for ProLiant Servers, Local Virus Infection

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c01404119

Version: 1

HPSBMA02323 SSRT080032 rev.1 - HP USB Floppy Drive Key (Option) for ProLiant Servers, Local Virus Infection
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2008-04-03

Last Updated: 2008-04-03


Potential Security Impact: Local virus infection.

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY

A potential security vulnerability has been identified with two types of optional HP USB Floppy Drive Keys intended for use with certain ProLiant servers. This vulnerability could cause a local 'W32.Fakerecy' or 'W32.SillyFDC' virus infection.

References: CVE-2008-0708

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

Option Part # 442084-B21 HP 256MB USB 2.0 Floppy Drive Key
Option Part # 442085-B21 HP 1GB USB 2.0 Floppy Drive Key

The optional Floppy Drive Keys listed above could be used on the following servers:
ProLiant BL20pG4; ProLiant BL25pG2
ProLiant BL45pG2
ProLiant BL260c
ProLiant BL460c; ProLiant BL465c; ProLiant BL465cG5; ProLiant BL480c
ProLiant BL680cG5; ProLiant BL685c; ProLiant BL685cG5
ProLiant DL120G5; ProLiant DL140G3; ProLiant DL145G3; ProLiant DL160G5; ProLiant DL165G5; ProLiant DL180; ProLiant DL180G5; ProLiant DL185G5
ProLiant DL320G5; ProLiant DL320G5p; ProLiant DL320s; ProLiant DL360G5; ProLiant DL365; ProLiant DL365G5; ProLiant DL380G5; ProLiant DL385G2; ProLiant DL385G5
ProLiant DL580G4; ProLiant DL580G5; ProLiant DL585G2; ProLiant DL585G5
ProLiant ML110G4; ProLiant ML110G5; ProLiant ML115; ProLiant ML115G5; ProLiant ML150G3; ProLiant Ml150G5
ProLiant ML310G4; ProLiant ML310G5; ProLiant ML350G5; ProLiant ML370G5
ProLiant ML570G4
IP Console Switch with virtual media
Server Console switch
Server Console Switch with virtual media
TFT7600 (USB Pass-through)
1U Rackmount Keyboard with USB

BACKGROUND

For a PGP signed version of this security bulletin please write to: security-alert@hp.com

CVSS 2.0 Base Metrics

Reference
Base Vector
Base Score
CVE-2008-0708
(AV:L/AC:L/Au:S/C:N/I:N/A:P)
1.7

Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.

Virus Information: W32.Fakerecy and W32.SillyFDC
Discovered: January/February 2007
Type: Worm
Threat Level: Low
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows NT, Windows 2000
Virus detail: W32.Fakerecy and W32.SillyFDC are worms that spread by copying themselves to removable and/or mapped drives.

RESOLUTION

HP is providing the following procedure to resolve this vulnerability:

  1. HP recommends that the optional HP USB Floppy Drive Key be checked for the potential virus infections and cleaned. To detect and clean this virus infection the HP USB Floppy Drive Key can be plugged into a USB 2.0 port on a system with current (up-to-date) anti-virus software and scanned
  2. If the optional HP USB Floppy Drive Key has been used in an environment without current (up-to-date) anti-virus software then the W32.Fakerecy or W32.SillyFDC virus may have spread to any mapped drives on the server. In this case HP recommends that the server and mapped drives are scanned with current (up-to-date) anti-virus software
This virus infection would have been immediately detected and cleaned if the optional HP USB Floppy Drive Key had been used in an environment with any current (up-to-date) anti-virus software

Note: These are standard USB 2.0 Floppy Drive Keys (similar to 'Flash Drives') that can be plugged into a USB 2.0 port on any system.


PRODUCT SPECIFIC INFORMATION
None

HISTORY
Version: 1 (rev.1) - 3 April 2008 Initial release

Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.

©Copyright 2008 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.

Provide feedback

Please rate the information on this page to help us improve our content. Thank you!