HP Openview Network Node Manager shell metacharacter command execution
| hp-openview-node-manager-command-execution (21999) |  High Risk |
Description:
HP OpenView Network Node Manager (OV NNM) could allow a remote attacker to execute arbitrary commands on the system. A remote attacker could pass malicious shell metacharacters to the connectedNodes.ovpl, cdpView.ovpl, freeIPaddres.ovpl, or ecscmg.ovpl script using the "node" parameter, which would allow the attacker to execute arbitrary commands and gain elevated privileges on the system.
Consequences:
Gain Access
Remedy:
Refer to Hewlett-Packard Company Security Bulletin HPSBMA01224 for upgrade and recommended workaround information. See References.
References:
- BugTraq Mailing List, Thu Aug 25 2005 - 10:04:40 CDT: Portcullis Security Advisory 05-014 HP Openview Remote Command Execution Vulnerability.
- CIAC INFORMATION BULLETIN P-293: HP Openview Network Node Manager (OV NNM) Remote Unauthorized Access.
- Hewlett-Packard Company Security Bulletin HPSBMA01224: HP OpenView Network Node Manager (OV NNM) Remote Unauthorized Privileged Access.
- Network Node Manager (NNM) advanced edition 7.0: Network Node Manager advanced edition.
- BID-14662: HP OpenView Network Node Manager Multiple Remote Command Execution Vulnerabilities
- CVE-2005-2773: HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.
- SA16555: HP Openview Network Node Manager Arbitrary Command Execution
Platforms Affected:
- HP HP-UX B.11.00
- HP HP-UX B.11.11
- HP HP-UX B.11.23
- HP OpenView Network Node Manager 6.20
- HP OpenView Network Node Manager 6.4
- HP OpenView Network Node Manager 6.41
- HP OpenView Network Node Manager 7.01
- HP OpenView Network Node Manager 7.50
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8
- Sun Solaris 9
Reported:
Aug 23, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net