HP OpenView Network Node Manager Multiple Remote Code Execution Vulnerabilities

Bugtraq ID:	45762
Class:	Unknown
CVE:	CVE-2011-0261 CVE-2011-0262 CVE-2011-0263 CVE-2011-0264 CVE-2011-0265 CVE-2011-0266 CVE-2011-0267 CVE-2011-0268 CVE-2011-0269 CVE-2011-0270 CVE-2011-0271
Remote:	Yes
Local:	No
Published:	Jan 11 2011 12:00AM
Updated:	Mar 23 2011 01:26PM
Credit:	SilentSignal along with TippingPoint's Zero Day Initiative; an anonymous researcher along with TippingPoint's Zero Day Initiative; an anonymous researcher working with the iDefense VCP
Vulnerable:	HP OpenView Network Node Manager 7.53 HP OpenView Network Node Manager 7.51
Not Vulnerable:

HP OpenView Network Node Manager Multiple Remote Code Execution Vulnerabilities

HP OpenView Network Node Manager is prone to multiple remote code-execution vulnerabilities.

Successful exploits may allow an attacker to execute arbitrary code with the privileges of the user running the application's webserver. Failed exploit attempts will likely result in denial-of-service conditions.

OpenView Network Node Manager 7.51 and 7.53 are vulnerable.

HP OpenView Network Node Manager Multiple Remote Code Execution Vulnerabilities

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit is available for CVE-2011-0266:

• /data/vulnerabilities/exploits/45762.rb

HP OpenView Network Node Manager Multiple Remote Code Execution Vulnerabilities

Solution:
Updates are available. Please see the references for details.


HP OpenView Network Node Manager 7.53

• HP PHSS_41606
  http://support.openview.hp.com/selfsolve/patches


• HP PSOV_03531
  http://support.openview.hp.com/selfsolve/patches


• HP LXOV_00114
  http://support.openview.hp.com/selfsolve/patches


• HP LXOV_00113
  http://support.openview.hp.com/selfsolve/patches


• HP PHSS_41607
  http://support.openview.hp.com/selfsolve/patches


• HP NNM_01208
  http://support.openview.hp.com/selfsolve/patches

HP OpenView Network Node Manager Multiple Remote Code Execution Vulnerabilities

References:

• OpenView Homepage (HP)
  
• HPSBMA02621 SSRT100352 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote ([email protected])
  
• ZDI-11-003 HP OpenView Network Node Manager jovgraph.exe displayWidth Remote Cod (Zero Day Initiative)
  
• ZDI-11-004 HP OpenView Network Node Manager ovutil.dll stringToSeconds Remote Co (Zero Day Initiative)
  
• ZDI-11-005 HP OpenView Network Node Manager ovas.exe Remote Code Execution Vulne (Zero Day Initiative)
  
• ZDI-11-006 Hewlett-Packard Network Node Manager OVutil.dll Remote Code Execution (Zero Day Initiative)
  
• ZDI-11-007 Hewlett-Packard OpenView Network Node Manager nnmRptConfig.exe data_s (Zero Day Initiative)
  
• ZDI-11-008 Hewlett-Packard OpenView Network Node Manager nnmRptConfig.exe namePa (Zero Day Initiative)
  
• ZDI-11-009 Hewlett-Packard OpenView Network Node Manager nnmRptConfig.exe schdPa (Zero Day Initiative)
  
• ZDI-11-010 Hewlett-Packard OpenView Network Node Manager nnmRptConfig.exe namePa (Zero Day Initiative)
  
• ZDI-11-011 Hewlett-Packard OpenView Network Node Manager nnmRptConfig.exe schd_s (Zero Day Initiative)
  
• ZDI-11-012 Hewlett-Packard OpenView Network Node Manager nnmRptConfig.exe Remote (Zero Day Initiative)