Secunia

Two vulnerabilities have been reported in HP OpenView Network Node Manager, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) The vulnerability is caused due to an error in the database service (ovdbrun.exe) when processing TCP packets. This can be exploited to terminate the service via a specially crafted packet sent to TCP port 2690, containing an invalid error code.

2) An unspecified error can be exploited to potentially execute arbitrary code. No further information is currently available.

The vulnerabilities are reported in versions 7.51 and 7.53 running on HP-UX, Linux, Solaris, and Windows.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Damián Frizza, Core Security Technologies
2) The vendor credits an anonymous researcher via iDefense VCP.

Changelog
Further details available in Customer Area

Original Advisory
HPSBMA02477 SSRT090177:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01926980

Core Security Technologies:
http://www.coresecurity.com/content/openview_nnm_internaldb_dos

Deep Links
Links available in Customer Area