A vulnerability has been reported in HP LoadRunner and HP Performance Center, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an unspecified error in magentproc.exe, which can be exploited to execute local commands with SYSTEM privileges by sending a specially crafted packet to port 54345/TCP.

The vulnerability is reported in the following products:
* HP LoadRunner Agent running on Windows, supplied with LoadRunner prior to v9.50.
* HP Performance Center Agent running on Windows, supplied with HP Performance Center prior to v9.50.

Solution
Update to version 9.50 and enable the "Secure Channel" feature.

Provided and/or discovered by
Tenable Network Security, reported via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
HP (HPSBMA02201 SSRT071328):
https://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c00912968

HP (HPSBMA02528 SSRT100106):
https://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02153865

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-080/

Deep Links
Links available to Secunia VIM customers