---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: HP OpenView Network Node Manager Multiple Vulnerabilities SECUNIA ADVISORY ID: SA37665 VERIFY ADVISORY: http://secunia.com/advisories/37665/ DESCRIPTION: Some vulnerabilities have been reported in HP OpenView Network Node Manager, which can be exploited by malicious people to compromise a vulnerable system. 1) An unspecified error can be exploited to cause a buffer overflow by sending a specially crafted HTTP request. 2) Input passed via the "hostname" HTTP header to certain Perl CGI executables in the Network Node Manager HTTP server is not properly sanitised before being used. This can be exploited to inject and execute arbitrary shell commands via the pipe character. 3) A boundary error exists within snmp.exe when copying strings from an HTTP request using the "sprintf()" function. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Oid" parameter. 4) A boundary error exists within nnmRptConfig.exe when copying strings from an HTTP request using the "vsprintf()" function. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Template" parameter. 5) A boundary error exists within nnmRptConfig.exe when copying strings from an HTTP request using the "strcat()" function. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Template" parameter. 6) A boundary error exists within ovlogin.exe when copying strings from an HTTP request using the "sprintf()" function. This can be exploited to cause a heap-based buffer overflow by passing an overly long string to the "userid" and "passwd" parameters. 7) A boundary error exists within ovsessionmgr.exe when copying strings from an HTTP request using the "sprintf()" function. This can be exploited to cause a heap-based buffer overflow by passing an overly long string to the "userid" and "passwd" parameters. 8) A boundary error exists within webappmon.exe when copying strings from an HTTP request using the "strcat()" function. This can be exploited to cause a buffer overflow by passing an overly long string to the "Host" HTTP header. 9) A boundary error exists within OvWebHelp.exe when copying strings from an HTTP request during the string concatenation process. This can be exploited to cause a heap-based buffer overflow by passing an overly long string to the "Topic" parameter. 10) A boundary error exists within ovalarm.exe, which can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Accept-Language" HTTP header when the "OVABverbose" parameter is set. 11) A boundary error exists within snmpviewer.exe when copying strings using the "strcat()" function. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Host" HTTP header. 12) A boundary error exists within ovwebsnmpsrv.exe when copying strings from an HTTP request. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "arg" parameter. 13) A vulnerability is caused due to an unspecified error. No further information is currently available. Successful exploitation may allow execution of arbitrary code. The vulnerabilities are reported in versions 7.01, 7.51, and 7.53 running on HP-UX, Linux, Solaris, and Windows. SOLUTION: Apply patches: http://support.openview.hp.com/selfsolve/patches -- HP OpenView Network Node Manager 7.53 -- HP-UX (IA): Apply patch PHSS_40375 or subsequent. HP-UX (PA): Apply patch PHSS_40374 or subsequent. Linux RedHatAS2.1: Apply patch LXOV_00101 or subsequent. Linux RedHat4AS-x86_64: Apply patch LXOV_00102 or subsequent. Solaris: Apply patch PSOV_03525 or subsequent. Windows: Apply patch NNM_01201 or subsequent. -- HP OpenView Network Node Manager 7.51 -- Upgrade to version 7.53 and apply patches. -- HP OpenView Network Node Manager 7.01 -- HP-UX (PA): Apply patch PHSS_36773 or subsequent (NNM701_IP12_hotfix_hpux.tar). Solaris: Apply patch PSOV_03480 or subsequent (NNM701_IP12_hotfix_solaris.tar). Windows: Apply patch NNM_01159 or subsequent (NNM701_IP12_hotfix_windows.zip). PROVIDED AND/OR DISCOVERED BY: 1) Takehiro Takahashi, IBM X-Force. 2 - 5) An anonymous person, reported via ZDI. 6 - 12) Aaron Portnoy, TippingPoint DVLabs. 13) Reported by the vendor. ORIGINAL ADVISORY: HPSBMA02483 SSRT090257: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877 IBM X-Force: http://www.iss.net/threats/357.html ZDI: http://www.zerodayinitiative.com/advisories/ZDI-09-094 http://www.zerodayinitiative.com/advisories/ZDI-09-095 http://www.zerodayinitiative.com/advisories/ZDI-09-096 http://www.zerodayinitiative.com/advisories/ZDI-09-097 TippingPoint DVLabs: http://dvlabs.tippingpoint.com/advisory/TPTI-09-08 http://dvlabs.tippingpoint.com/advisory/TPTI-09-09 http://dvlabs.tippingpoint.com/advisory/TPTI-09-10 http://dvlabs.tippingpoint.com/advisory/TPTI-09-11 http://dvlabs.tippingpoint.com/advisory/TPTI-09-12 http://dvlabs.tippingpoint.com/advisory/TPTI-09-13 http://dvlabs.tippingpoint.com/advisory/TPTI-09-14 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------