Discover Vulnerable HP Support Assistant in Your IT Estate
HP released a new security advisory detailing a vulnerability in their Support Assistant software that is installed by default on all of their devices. HP Support Assistant is used to troubleshoot issues with HP devices, do hardware diagnostic testing, provide detailed hardware information, and check for BIOS and other driver updates. You can read more about this vulnerability in the HP Support Assistant blog post.
The report below provides an overview of file scanning results from the directory below where the HPSupportAssistant.dll file version is lower than 9.11.0.0
Before running the audit, add the following target to your Lansweeper file property scan configuration.
%programfiles(x86)%HPHP Support FrameworkHPSupportAssistant.dll
HP Support Assistant Vulnerability File Properties Query
Select Top 1000000 tsysOS.Image As icon,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
tblAssets.IPAddress,
SubQuery1.PatchSearched,
SubQuery1.FileVersion,
SubQuery1.Filesize,
Case
When TsysLastscan.Lasttime < GetDate() - 1 Then
'Last file scan more than 24 hours ago! Scanned file information may not be up-to-date. Try rescanning this machine.'
End As Comment,
SubQuery1.CreationDate,
SubQuery1.LastAccessed,
SubQuery1.LastModified,
tblAssets.Firstseen,
tblAssets.Lastseen,
tblAssets.Lasttried,
TsysLastscan.Lasttime As LastFileScan,
SubQuery1.Lastchanged
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Inner Join TsysLastscan On tblAssets.AssetID = TsysLastscan.AssetID
Inner Join TsysWaittime On TsysWaittime.CFGCode = TsysLastscan.CFGcode
Left Join (Select Top 1000000 tblFileVersions.AssetID,
tblFileVersions.FilePathfull As PatchSearched,
tblFileVersions.Found,
tblFileVersions.FileVersion,
tblFileVersions.CompanyName,
tblFileVersions.Filesize,
tblFileVersions.Lastchanged,
tblFileVersions.CreationDate,
tblFileVersions.LastAccessed,
tblFileVersions.LastModified
From tblFileVersions
Where tblFileVersions.FilePathfull Like '%hpsupportassistant.dll') SubQuery1
On SubQuery1.AssetID = tblAssets.AssetID
Where SubQuery1.PatchSearched Like '%hpsupportassistant.dll' And
tblAssetCustom.State = 1 And TsysWaittime.CFGname = 'files' And
SubQuery1.Found = 1 and ((Cast(ParseName(SubQuery1.FileVersion, 4) As bigint) < 9) Or
(Cast(ParseName(SubQuery1.FileVersion, 4) As bigint) = 9 And
Cast(ParseName(SubQuery1.FileVersion, 3) As bigint) < 11))
Order By tblAssets.Domain,
tblAssets.AssetName
