SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

Multiple vulnerabilities in HP OpenView NNM 7.53


Arrow  SecurityAlert : 4397
Arrow  CVE : CVE-2008-3544
Arrow  CWE : CWE-119
Arrow  SecurityRisk : High  Security Risk High  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Victim interaction required : No
Arrow  Exploit Available : No
Arrow  Credit : Luigi Auriemma
Arrow  Published : 14.10.2008

Arrow  Affected Software : hp:openview_network_node_manager:7.50
hp:openview_network_node_manager:7.53
hp:openview_network_node_manager:7.51
hp:openview_network_node_manager:7.01



Arrow  Advisory Content :  

#######################################################################

Luigi Auriemma

Application: HP OpenView Network Node Manager
http://www.openview.hp.com/products/nnm/
Versions: <= 7.53
Platforms: Windows (tested), Solaris, Linux, HP-UX
Bugs: A] format string in ovalarmsrv
B] multiple buffer-overflows in ovalarmsrv
C] Denial of Service in ovalarmsrv
Exploitation: remote
Date: 07 Apr 2008
Author: Luigi Auriemma
e-mail: aluigi (at) autistici (dot) org [email concealed]
web: aluigi.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

From vendor's website:
OpenView NNM "automates the process of developing a hyper-accurate
topology of your physical network, virtual network services and the
complex relationships between them. It then uses that topology as the
basis for intelligent root cause analysis to enhance network
availability and performance."

#######################################################################

=======
2) Bugs
=======

------------------------------
A] format string in ovalarmsrv
------------------------------

The ovalarmsrv.exe process listening on port 2953 is affected by a
format string vulnerability caused by the calling of ov.fprintf_new
(which then calls vsprintf) using the final message without a format
argument:

"Connection Refused; Data in listener port corrupt: ATTACKER_STRING"

------------------------------------------
B] multiple buffer-overflows in ovalarmsrv
------------------------------------------

The same process listens also on port 2954 where are handled some types
of requests using specific sscanf formats:

REQUEST_SEV_CHANGE (47): "%d %d %d %[^\n]"
REQUEST_SAVE_STATE (61): "%d %[^\n]s"
REQUEST_LOCAL (66): "%d"
REQUEST_RESTORE_STATE (62): "%d %s"
REQUEST_SAVE_DIR (63):

As visible by the previous format arguments there are no checks on the
length of the client string handled by the requests 47, 61 and 62 which
can be used to exploit a stack based buffer-overflow vulnerability
using a string parameter longer than 512 bytes.

----------------------------------
C] Denial of Service in ovalarmsrv
----------------------------------

Another problem of the ovalarmsrv service is that it can be easily
freezed with CPU at 100% and without the possibility of handling
further requests on port 2953/2954 simply sending some invalid values.

#######################################################################

===========
3) The Code
===========

A]
echo %n%n%s%n%n%s | nc SERVER 2953 -v -v

B]
echo 62 AAAAAAAAAAAAA...512_'A's...AAAAAAAAAAAAA | nc SERVER 2954 -v -v

C]
echo 47 1 2 what_you_want | nc SERVER 2954 -v -v -w 1

#######################################################################

======
4) Fix
======

No fix

#######################################################################

---
Luigi Auriemma
http://aluigi.org



Arrow  References :

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01537275
http://www.securityfocus.com/bid/28668
http://www.securityfocus.com/archive/1/490541
http://secunia.com/advisories/31688
http://downloads.securityfocus.com/vulnerabilities/exploits/28668.c
http://aluigi.altervista.org/adv/closedview_old-adv.txt




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...
Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration
PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass
Copyright © SecurityReason.com. All Rights Reserved.