James Fisher has reported a vulnerability in HP Openview Network Node Manager, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "node" parameter in cgi-bin/connectedNodes.ovpl is not properly sanitised before being used as command line arguments. This can be exploited to execute arbitrary shell commands via a specially crafted string containing shell meta characters.

The cdpView.ovpl, freeIPaddrs.ovpl, and ecscmg.ovpl scripts are reportedly also vulnerable.

The vulnerability affects versions 6.20, 6.4x, 7.01, and 7.50 running on HP-UX B.11.00, B.11.11, and B.11.23, Solaris, Windows NT, Windows 2000, Windows XP, and Linux.

Solution
Apply patches (see vendor advisory for details).

Provided and/or discovered by
James Fisher, Portcullis Computer Security.

Additional information about three other scripts:
* David Litchfield

Changelog
Further details available in Customer Area

Original Advisory
HP SSRT051023:
http://www4.itrc.hp.com/service/cki/docDisplay.do?docId=c00604164

Deep Links
Links available in Customer Area