Some vulnerabilities have been reported in HP OpenView Network Node Manager, which can be exploited by malicious people to compromise a vulnerable system.

1) An unspecified error can be exploited to cause a buffer overflow by sending a specially crafted HTTP request.

2) Input passed via the "hostname" HTTP header to certain Perl CGI executables in the Network Node Manager HTTP server is not properly sanitised before being used. This can be exploited to inject and execute arbitrary shell commands via the pipe character.

3) A boundary error exists within snmp.exe when copying strings from an HTTP request using the "sprintf()" function. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Oid" parameter.

4) A boundary error exists within nnmRptConfig.exe when copying strings from an HTTP request using the "vsprintf()" function. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Template" parameter.

5) A boundary error exists within nnmRptConfig.exe when copying strings from an HTTP request using the "strcat()" function. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Template" parameter.

6) A boundary error exists within ovlogin.exe when copying strings from an HTTP request using the "sprintf()" function. This can be exploited to cause a heap-based buffer overflow by passing an overly long string to the "userid" and "passwd" parameters.

7) A boundary error exists within ovsessionmgr.exe when copying strings from an HTTP request using the "sprintf()" function. This can be exploited to cause a heap-based buffer overflow by passing an overly long string to the "userid" and "passwd" parameters.

8) A boundary error exists within webappmon.exe when copying strings from an HTTP request using the "strcat()" function. This can be exploited to cause a buffer overflow by passing an overly long string to the "Host" HTTP header.

9) A boundary error exists within OvWebHelp.exe when copying strings from an HTTP request during the string concatenation process. This can be exploited to cause a heap-based buffer overflow by passing an overly long string to the "Topic" parameter.

10) A boundary error exists within ovalarm.exe, which can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Accept-Language" HTTP header when the "OVABverbose" parameter is set.

11) A boundary error exists within snmpviewer.exe when copying strings using the "strcat()" function. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "Host" HTTP header.

12) A boundary error exists within ovwebsnmpsrv.exe when copying strings from an HTTP request. This can be exploited to cause a stack-based buffer overflow by passing an overly long string to the "arg" parameter.

Successful exploitation may allow execution of arbitrary code.

The vulnerabilities are reported in versions 7.01, 7.51, and 7.53 running on HP-UX, Linux, Solaris, and Windows.

Solution
Apply patches:
Further details available in Customer Area

Provided and/or discovered by
1) Takehiro Takahashi, IBM X-Force.
2 - 5) An anonymous person, reported via ZDI.
6 - 12) Aaron Portnoy, TippingPoint DVLabs.

Changelog
Further details available in Customer Area

Original Advisory
HPSBMA02483 SSRT090257:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877

IBM X-Force:
http://www.iss.net/threats/357.html

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-09-094
http://www.zerodayinitiative.com/advisories/ZDI-09-095
http://www.zerodayinitiative.com/advisories/ZDI-09-096
http://www.zerodayinitiative.com/advisories/ZDI-09-097

TippingPoint DVLabs:
http://dvlabs.tippingpoint.com/advisory/TPTI-09-08
http://dvlabs.tippingpoint.com/advisory/TPTI-09-09
http://dvlabs.tippingpoint.com/advisory/TPTI-09-10
http://dvlabs.tippingpoint.com/advisory/TPTI-09-11
http://dvlabs.tippingpoint.com/advisory/TPTI-09-12
http://dvlabs.tippingpoint.com/advisory/TPTI-09-13
http://dvlabs.tippingpoint.com/advisory/TPTI-09-14

Technical Analysis
Further details available in Customer Area

Deep Links
Links available in Customer Area