Multiple vulnerabilities have been reported in HP OpenView Network Node Manager, which can be exploited by malicious people to compromise a vulnerable system.

1) An error when processing certain parameters within the webappmon.exe CGI program can be exploited to corrupt memory.

2) A boundary error when processing the "nameParams" parameters within the nnmRotConfig.exe CGI program can be exploited to cause a heap-based buffer overflow.

3) A boundary error within ov.dll when processing a file name for the textFile option can be exploited to cause a stack-based buffer overflow.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in versions 7.51 and 7.53 running on HP-UX, Linux, Solaris, and Windows.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Aniway.Anyway@gmail.com via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
HPSBMU02712 SSRT100649:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03054052

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-348/
http://www.zerodayinitiative.com/advisories/ZDI-12-002/
http://www.zerodayinitiative.com/advisories/ZDI-12-003/

Deep Links
Links available to Secunia VIM customers