HP OpenView Network Node Manager Directory Traversal and Multiple Denial Of Service Vulnerabilities

Bugtraq ID:	28745
Class:	Unknown
CVE:	CVE-2008-0068 CVE-2008-1851 CVE-2008-1852 CVE-2008-1853
Remote:	Yes
Local:	No
Published:	Apr 11 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	Luigi Auriemma; JJ Reyes of Secunia Research discovered the directory-traversal issue independently
Vulnerable:	Nortel Networks Multiservice Switch - MDM 0 Nortel Networks Multiservice Data Manager 0 Nortel Networks Enterprise Network Management System Nortel Networks ENSM - Enterprise NMS 10.5 Nortel Networks ENSM - Enterprise NMS 10.4 HP OpenView Network Node Manager 7.53 HP OpenView Network Node Manager 7.51 HP OpenView Network Node Manager 7.01
Not Vulnerable:

HP OpenView Network Node Manager Directory Traversal and Multiple Denial Of Service Vulnerabilities

HP OpenView Network Node Manager is prone to multiple vulnerabilities affecting the 'ovalarmsrv.exe' and 'ovtopmd.exe' processes. These issues include a directory-traversal issue and multiple denial-of-service issues.

UPDATE (April 14, 2008): Secunia Research discovered, independently, that the 'OpenView5.exe' process is also prone to the directory-traversal issue; this affects Network Node Manager 7.51. Note that 'ovalarmsrv.exe' may also be named 'OpenView5.exe'.

Attackers can exploit these issues to access potentially sensitive data on the affected computer or to deny service to legitimate users.

HP OpenView Network Node Manager 7.53 is vulnerable; other versions may also be affected.

HP OpenView Network Node Manager Directory Traversal and Multiple Denial Of Service Vulnerabilities

The following proofs of concept are available:

http://www.example.com/OvCgi/OpenView5.exe?Target=Main&Action=../../../../../../windows/win.ini

nc SERVER 2954 -v -v < 28745-1.txt
nc SERVER 2532 -v -v < 28745-2.txt

• /data/vulnerabilities/exploits/28745-1.txt
• /data/vulnerabilities/exploits/28745-2.txt

HP OpenView Network Node Manager Directory Traversal and Multiple Denial Of Service Vulnerabilities

Solution:
The vendor has released updates. Please see the references for more information.


HP OpenView Network Node Manager 7.53

• HP NNM_01193
  Windows
  http://support.openview.hp.com/selfsolve/patches

HP OpenView Network Node Manager 7.01

• HP NNM_01194
  Windows
  http://support.openview.hp.com/selfsolve/patches

HP OpenView Network Node Manager Directory Traversal and Multiple Denial Of Service Vulnerabilities

References:

• HP OpenView Network Node Manager Product Page (HP)
  
• Secunia Research: HP OpenView Network Node Manager OpenView5.exe Directory Trav (Secunia Research )
  
• Directory traversal and multiple Denials of Service in HP OpenView (Luigi Auriemma )
  
• HP OpenView Network Node Manager OpenView5.exe Directory Traversal (Secunia Research)
  
• Nortel Response to HP Openview Network Node Manager Potential Vulnerabilities (Nortel Networks)