HP System Management Homepage < 7

Tenable plugin 76345 flags HP System Management Homepage (SMH) 7.3.2 and earlier on Linux/Windows for multiple bundled OpenSSL issues: CVE-2010-5298, CVE-2014-0076, CVE-2014-0195, CVE-2014-0198, CVE-2014-0221, CVE-2014-0224, and CVE-2014-3470. HPE fixed this line in SMH 7.3.3.1, with 7.2.4.1 only for the Windows 2003 branch; HPE also noted Linux x86 7.3.3.1 still ships OpenSSL 1.0.0d, but said the practical CVE-2014-0224 risk depends on what it talks to.

The vendor/plugin MEDIUM call is not outrageous, but for patch triage across a big estate it is still too hot. Most of the scary CVEs in this bundle are not reachable through normal SMH use: the best technical RCE candidate is DTLS-only (CVE-2014-0195), two bugs need DTLS client mode (CVE-2014-0221) or anonymous ECDH client use (CVE-2014-3470), two require SSL_MODE_RELEASE_BUFFERS enabled, which OpenSSL says is not the default and not common, and the remaining notable issue (CVE-2014-0224) is a man-in-the-middle condition that needs both ends vulnerable. On a management page typically reached by standard admin browsers over an internal network, that is a narrow, high-friction chain.

Why this verdict

• DTLS kills the scariest path: the plugin's CVSS baseline is anchored to CVE-2014-0195, but that bug is DTLS-only. SMH is normally an HTTPS web service on 2381, so the headline RCE path does not map to the common deployment.
• Best remaining path needs attacker-in-the-middle: CVE-2014-0224 is the residual concern, but OpenSSL says the attack requires a vulnerable client and server plus a real MITM position. That implies prior network foothold, local segment control, or insider access.
• Other bundled CVEs are edge-case noise here: CVE-2014-0221 is DTLS client-only, CVE-2014-3470 hits TLS clients using anonymous ECDH, CVE-2014-0198 and CVE-2010-5298 require SSL_MODE_RELEASE_BUFFERS, and CVE-2014-0076 is a cache side-channel. Each prerequisite further narrows the exposed population.

Why not higher?

There is no clean evidence here of a reliable unauthenticated remote exploit against the normal SMH web service. The plugin is mostly inheriting risk from the bundled OpenSSL version, while the actual SMH attack surface removes or sharply constrains the most severe exploit chains.

Why not lower?

I did not drop this to IGNORE because SMH is still a server-management interface, and if it is exposed on a flat admin network or externally, even a MITM-oriented flaw matters more than it would on a random desktop app. Also, some estates really did leave legacy HP management services reachable on 2381, so there is still meaningful hygiene value in fixing or retiring it.

1. Restrict 2381/tcp and 2301/tcp — Allow access only from dedicated admin jump hosts or management VLANs. For a LOW verdict there is no SLA; treat as backlog hygiene, but if any SMH instance is internet-reachable or broadly reachable from user networks, cut exposure immediately because segmentation removes the only realistic remote path.
2. Retire unused SMH — If the host no longer needs HP SMH, disable or remove it instead of carrying a dead management surface forever. For LOW, this is backlog hygiene with no fixed SLA, but it usually buys down more risk than patching a legacy console you never use.
3. Verify admin path — Confirm whether admins access SMH only from modern browsers and over controlled paths such as VPN or jump boxes. For LOW, there is no mitigation SLA, but validating the admin path is the fastest way to prove the CVE-2014-0224 MITM scenario is non-viable in your environment.
4. Inventory and patch on touch — Use Nessus plus local smhlogreader -version checks to inventory versions, then patch or retire during the next planned maintenance affecting those servers. For LOW, this is backlog hygiene, not an emergency patch cycle.

Run this on the target host or from an auditor workstation with network reachability to the SMH port. Invoke it as python3 check_hpsmh_76345.py --host server01 --port 2381 or locally as python3 check_hpsmh_76345.py; it needs only normal user rights for a remote banner check, but local smhlogreader execution may require the binary to be present in the product install path.

#!/usr/bin/env python3
# check_hpsmh_76345.py
# Verify exposure for Tenable plugin 76345 (HP SMH bundled OpenSSL issues)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import socket
import ssl
import subprocess
import sys
from typing import Optional, Tuple


def parse_ver(v: str):
    nums = re.findall(r'\d+', v)
    return tuple(int(x) for x in nums[:4])


def cmp_ver(a: Tuple[int, ...], b: Tuple[int, ...]) -> int:
    maxlen = max(len(a), len(b))
    a = a + (0,) * (maxlen - len(a))
    b = b + (0,) * (maxlen - len(b))
    return (a > b) - (a < b)


def classify_smh_version(v: str) -> str:
    # HPE fixed branch points cited by the bulletin:
    # - 7.3.3.1 fixed for Linux/Windows
    # - 7.2.4.1 fixed for Windows 2003 branch only
    try:
        pv = parse_ver(v)
    except Exception:
        return 'UNKNOWN'

    if cmp_ver(pv, parse_ver('7.3.3.1')) >= 0:
        return 'PATCHED'
    if cmp_ver(pv, parse_ver('7.2.4.1')) >= 0 and cmp_ver(pv, parse_ver('7.3.0.0')) < 0:
        return 'PATCHED'
    if cmp_ver(pv, parse_ver('7.3.2.0')) <= 0:
        return 'VULNERABLE'
    return 'UNKNOWN'


def run_cmd(path: str) -> Optional[str]:
    if not os.path.exists(path):
        return None
    try:
        proc = subprocess.run([path, '-version'], capture_output=True, text=True, timeout=10)
        out = (proc.stdout or '') + '\n' + (proc.stderr or '')
        return out.strip()
    except Exception:
        return None


def local_smh_version() -> Optional[str]:
    candidates = []
    if platform.system().lower().startswith('win'):
        candidates = [
            r'C:\hp\hpsmh\bin\smhlogreader.exe',
            r'C:\hp\hpsmh\bin\smhlogreader'
        ]
    else:
        candidates = [
            '/opt/hp/hpsmh/bin/smhlogreader',
            '/opt/hpsmh/bin/smhlogreader'
        ]

    for c in candidates:
        out = run_cmd(c)
        if out:
            m = re.search(r'(\d+\.\d+\.\d+(?:\.\d+)?)', out)
            if m:
                return m.group(1)
    return None


def remote_banner(host: str, port: int, timeout: int = 5) -> Tuple[Optional[str], Optional[str]]:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    try:
        with socket.create_connection((host, port), timeout=timeout) as sock:
            with ctx.wrap_socket(sock, server_hostname=host) as ssock:
                req = f'HEAD / HTTP/1.0\r\nHost: {host}\r\n\r\n'.encode()
                ssock.sendall(req)
                data = ssock.recv(4096).decode(errors='ignore')
                m = re.search(r'^Server:\s*(.+)$', data, re.I | re.M)
                banner = m.group(1).strip() if m else None
                vm = re.search(r'System Management Homepage/(\d+\.\d+\.\d+(?:\.\d+)?)', data, re.I)
                version = vm.group(1) if vm else None
                return banner, version
    except Exception:
        return None, None


def main():
    ap = argparse.ArgumentParser(description='Check HP SMH version for Tenable plugin 76345')
    ap.add_argument('--host', default='127.0.0.1', help='Target host for HTTPS banner check (default: 127.0.0.1)')
    ap.add_argument('--port', type=int, default=2381, help='Target HTTPS port (default: 2381)')
    args = ap.parse_args()

    local_ver = local_smh_version()
    if local_ver:
        status = classify_smh_version(local_ver)
        print(f'LOCAL_VERSION={local_ver}')
        print(status)
        sys.exit({'PATCHED': 0, 'VULNERABLE': 1}.get(status, 2))

    banner, remote_ver = remote_banner(args.host, args.port)
    if banner:
        print(f'SERVER_BANNER={banner}')
    if remote_ver:
        status = classify_smh_version(remote_ver)
        print(f'REMOTE_VERSION={remote_ver}')
        print(status)
        sys.exit({'PATCHED': 0, 'VULNERABLE': 1}.get(status, 2))

    print('UNKNOWN')
    print('No local smhlogreader found and no parsable remote SMH banner retrieved.')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Tenable plugin 76345
2. HPE bulletin HPSBMU03051 rev.2 (Bugtraq mirror)
3. OpenSSL security advisory 2014-06-05
4. NVD CVE-2014-0224
5. NVD CVE-2014-0195
6. HPE Heartbleed-era SMH notice with version-check commands
7. HPQhma/HPQsmh user guide showing SMH on https://hostname:2381
8. CISA Known Exploited Vulnerabilities Catalog