HP OpenView Network Node Manager 'execvp_nc()' Code Execution Vulnerability

Bugtraq ID:	41829
Class:	Boundary Condition Error
CVE:	CVE-2010-2703
Remote:	Yes
Local:	No
Published:	Jul 20 2010 12:00AM
Updated:	Mar 23 2011 10:39AM
Credit:	Anonymous researcher working with TippingPoint's Zero Day, Sebastien Renaud of VUPEN Vulnerability Research Team
Vulnerable:	HP OpenView Network Node Manager 7.53 HP OpenView Network Node Manager 7.51
Not Vulnerable:

HP OpenView Network Node Manager 'execvp_nc()' Code Execution Vulnerability

HP OpenView Network Node Manager (OV NNM) is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will completely compromise affected computers.

The issue affects HP OpenView Network Node Manager versions 7.51 and 7.53 running on the Windows platform.

HP OpenView Network Node Manager 'execvp_nc()' Code Execution Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following proof-of-concept and exploit is also available:

• /data/vulnerabilities/exploits/41829.py
• /data/vulnerabilities/exploits/41829.rb

HP OpenView Network Node Manager 'execvp_nc()' Code Execution Vulnerability

Solution:
Updates are available. Please see the references for details.


HP OpenView Network Node Manager 7.53

• HP PSOV_03531
  for Solaris
  http://support.openview.hp.com/selfsolve/patches


• HP NNM_01208
  for Windows
  http://support.openview.hp.com/selfsolve/patches


• HP LXOV_00113
  for Linux RedHatAS2.1
  http://support.openview.hp.com/selfsolve/patches


• HP PHSS_41606
  for HP-UX (PA)
  http://support.openview.hp.com/selfsolve/patches


• HP LXOV_00114
  for Linux RedHat4AS-x86_64
  http://support.openview.hp.com/selfsolve/patches


• HP PHSS_41607
  for HP-UX (IA)
  http://support.openview.hp.com/selfsolve/patches

HP OpenView Network Node Manager 'execvp_nc()' Code Execution Vulnerability

References:

• MOAUB #6 �?? HP OpenView NNM webappmon execvp_nc Remote Code Execution (Abysssec Research)
  
• VUPEN Security Research - HP OpenView Network Node Manager "nnmrptconfig.exe" Bu ("VUPEN Security Research" )
  
• HPSBMA02557 SSRT100025 rev.1- HP OpenView Network Node Manager (OV NNM) Running (HP)
  
• ZDI-10-137 Hewlett-Packard OpenView NNM webappmon.exe execvp_nc Remote Code Exec (Zero Day Initiative)