HP OpenView Network Node Manager 'ovdbrun.exe' Denial of Service Vulnerability

Bugtraq ID:	37046
Class:	Design Error
CVE:	CVE-2009-3840
Remote:	Yes
Local:	No
Published:	Nov 17 2009 12:00AM
Updated:	Jan 26 2010 04:41PM
Credit:	Damian Frizza from Core Security Technologies.
Vulnerable:	HP OpenView Network Node Manager 7.53 HP OpenView Network Node Manager 7.51
Not Vulnerable:

HP OpenView Network Node Manager 'ovdbrun.exe' Denial of Service Vulnerability

HP OpenView Network Node Manager (NNM) is prone to a remote denial-of-service vulnerability.

An attacker may leverage this issue to crash the affected application, denying service to affected users.

The issue affects NNM 7.51 and 7.53.

HP OpenView Network Node Manager 'ovdbrun.exe' Denial of Service Vulnerability

Attackers can exploit this issue by sending a specially crafted packet to a vulnerable computer.

The following example is available:

• /data/vulnerabilities/exploits/37046.py

HP OpenView Network Node Manager 'ovdbrun.exe' Denial of Service Vulnerability

Solution:
The vendor has released fixes. Please see the references for more information.


HP OpenView Network Node Manager 7.53

• HP LXOV_00087
  Linux RedHatAS2.1
  http://support.openview.hp.com/selfsolve/patches


• HP LXOV_00088
  Linux RedHat4AS-x86_64
  http://support.openview.hp.com/selfsolve/patches


• HP NNM_01193
  Windows
  http://support.openview.hp.com/selfsolve/patches


• HP PHSS_38488
  HP-UX (PA)
  http://support.openview.hp.com/selfsolve/patches


• HP PHSS_38489
  HP-UX (IA)
  http://support.openview.hp.com/selfsolve/patches


• HP PSOV_03515
  Solaris
  http://support.openview.hp.com/selfsolve/patches

HP OpenView Network Node Manager 'ovdbrun.exe' Denial of Service Vulnerability

References:

• HP OpenView Network Node Manager Product Page (HP)
  
• HP Openview NNM 7.53 Invalid DB Error Code vulnerability (Core Security Technologies)