HP OpenView Radia Notify Daemon Multiple Remote Buffer Overflow Vulnerabilities

Bugtraq ID:	13835
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 01 2005 12:00AM
Updated:	Jun 01 2005 12:00AM
Credit:	Discovery is credited to John Cartwright <[email protected]>.
Vulnerable:	HP OpenView Radia 4.0 HP OpenView Radia 3.1.2 .0 HP OpenView Radia 3.1 .0.0 HP OpenView Radia 2.0
Not Vulnerable:

HP OpenView Radia Notify Daemon Multiple Remote Buffer Overflow Vulnerabilities

HP OpenView Radia Notify Daemon (RADEXECD) is affected by multiple remote buffer overflow vulnerabilities.

An attacker can craft a malicious request that can overflow a buffer and result in process memory corruption. These issues may be exploited to gain unauthorized access in the context of the server.

HP OpenView Radia Notify Daemon Multiple Remote Buffer Overflow Vulnerabilities

The following proof of concept is available:
<callback port>\0<username>\0<password>\0
"LIST " . (0x90 x <offset>) . <ret_addr> . "." . <shellcode>

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HP OpenView Radia Notify Daemon Multiple Remote Buffer Overflow Vulnerabilities

Solution:
HP has released an advisory HPSBMA01143 (SSRT5962 rev.0 - HP OpenView Radia Management Applications - Radia) to address this issue. Please see the referenced advisory for more information in regards to obtaining and applying appropriate fixes.

HP OpenView Radia Notify Daemon Multiple Remote Buffer Overflow Vulnerabilities

References:

• OpenView Homepage (HP)
  
• [security bulletin] SSRT5962 rev.0 HP OpenView Radia mgmt - Remote access and Do ("Boren, Rich (SSRT)" )
  
• HP Radia Notify Daemon: Multiple Buffer Overflow Vulnerabilities (John Cartwright )