System Management Homepage Version Numbers

[Content Development Tea]

Hello!

I was wondering if anyone could fill me in on the versioning scheme that HP is using for System Management Homepage. They released 7.5.0.4 on June 15th and 7.2.6.3 on August 18th of this year. This same thing seems to have happened between 7.4.0.12 (September 9th, 2014) and 7.2.5.3 (January 30th, 2015). This makes detection, and therefore deployment (of System Management Homepage), very difficult since newer versions have lower version numbers. I noticed that Windows Server 2003 was not included in any of the supported operating systems list for SMH > 7.2.x.x, and I read in a forum post that PHP will break on Windows Server 2003 if SMH > 7.2 is installed. Is this the reason the versioning is like this? Is there a reliable way to find out if HP will release a lower version number for a newer product?

Thank you!

[Andrew_Haak]

I alway look at the revision history tab under the software pack i download to see what is the latest version. An older version number usualy mean the release is also for an older OS version like WIndows 2003. Look here for an example : http://h20564.www2.hpe.com/hpsc/swd/public/detail?sp4ts.oid=5177951&swItemId=MTX_72bb57e082104d6d96e22c4e2b&swEnvOid=4064#tab-history

[Content Development Tea]

So even though the date is later (Aug (7.2.6.3) vs. Jun (7.5.0.4)) it doesn't necessarily indicate that it is a newer version?

Attempting to "upgrade" from 7.5.0.4 to 7.2.6.3 greets me with the message:

Is it safe to assume then that a later version always indicates a newer version?

[Andrew_Haak]

Correct, Some fixes are for other platform like X64 or Windows 2008 or WIndows 2012. So not all OS versions use the same version numbers. This could be a new X64 version for Windows 2003 X64 or Windows 2008 R2. Always check the supported OS and install the latest version for your OS not the latest by date.

[Content Development Tea]

The only differences in applicability between 7.5.0.4 (x64) and 7.2.6.3 (x64) are:

• Microsoft Windows Unified Data Storage Server 2003 x64 Edition
• Microsoft Windows Server 2003 for 64-bit Extended Systems
• Microsoft Windows Storage Server 2003 x64 Editions
• Microsoft Windows Storage Server 2012

It seems the < = 7.2 line is applicable to Server 2K3 while the > 7.3 line excludes Server 2K3. Even though the bundled components are newer in the 7.2.6.3 patch, it is not possible to upgrade from 7.5.0.4 without first uninstalling. The opposite is possible though.

Theoretical: I have a Windows Server 2012 R2 box running SMH 7.4.2.4 (released Mar 30, 2015)

1. On June 15th I notice there is an update to 7.5.0.4. I take the upgrade and have a new version of OpenSSL (1.0.1m)
2. On August 18th I notice there is an update to 7.2.6.3 which includes OpenSSL 1.0.1o
• I have been waiting for a new version of OpenSSL to address CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791 and CVE-2015-1792.
3. I attempt to upgrade from 7.5.0.4 to 7.2.6.3 to fix the above vulnerabilities, only to be greeted by the error message in my previous response. 7.2.6.3 is newer, but I cannot follow an upgrade path that does not involve an uninstallation to have the latest version of OpenSSL with security fixes (this is a risk).

If you were to present me with a list of version numbers of SMH and ask me to pick the most secure (based solely on version number), I would currently pick 7.5.0.4. The truth is, when I "upgrade" from 7.2.6.3 to 7.5.0.4, I am now less secure due to having at least five known vulnerabilities in OpenSSL that I have effectively unpatched.

---

@Andrew_Haak wrote:
Always check the supported OS and install the latest version for your OS not the latest by date.

---

According to this, you are guiding me to install 7.5.0.4, which is inherently less secure 7.2.6.3. In a deployment situation where I scan my network for installed versions of SMH, I would see endpoints running 7.2.6.3 and "upgrade" them to 7.5.0.4, which is installing an older version and actually making them less secure. Is there something I am missing in this scenario or does it make sense?

Below is a comparison of the two versions in question, their supported OS list, and the version of OpenSSL included:

Comparison Of Versions

Thank you!

[Andrew_Haak]

Hello,

if you want to be sure i would contact HP as i sometimes also get confused by the versions. But if you need to uninstall a version first to install a higher version i would think it's not a valid update for the current installed version. I always look at the latest version and look if it's supported for you exact OS version.

as said before the confusion comes from x64 version that are not always listed for all x64 OS version like Windows 2003 x64, Windows 2008 (r2 or not), Windows 2012 and the R2 version of 2012. In it's different versions.