Abdul-Aziz Hariri has discovered a vulnerability in HP Performance Agent and HP Operations Agent, which can be exploited by malicious people to delete files on a vulnerable system.

The vulnerability is caused due to the OV Communications Broker service (ovbbccb.exe) deleting a file specified in a received "Register" or "Deregister" request. This can be exploited to delete arbitrary files on the system via specially crafted requests sent to TCP port 383.

The vulnerability is reported in the following products running on AIX, HP-UX, Linux, Solaris, and Windows:
* HP Performance Agent versions 4.70 and 5.0.
* HP Operations Agent 11.0, 8.60.0xx, 8.60.5xx, and 8.10.

Solution
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by
Abdul-Aziz Hariri via Secunia.

Independently discovered by Luigi Auriemma.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Luigi Auriemma:
http://aluigi.altervista.org/adv/ovbbccb_1-adv.txt

HPSBMU02691 SSRT100483:
http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02941034

Deep Links
Links available to Secunia VIM customers