HP Warns of Unpatched OpenView Hole

A vulnerability in OpenView could leave systems vulnerable to remote exploit. HP doesn't have a patch, but it does have recommendations.

 By Michael Hall | Posted Aug 31, 2005
Page of   |  Back to Page 1
Print Article

HP has warned that its network management tool suffers from a vulnerability security experts are calling "moderately critical."

According to a security bulletin posted on the HP web site (registration required), a vulnerability in the Openview Network Node Manager (OV NNM) could allow malicious people remote access to affected systems.

According to HP, there are problems with OV NNM versions 6.2, 6.4, 7.01 and 7.50 running on HP-UX, Solaris, Windows NT, Windows 2000, Windows XP and Linux.

According to an advisory posted on security company Secunia's Web site, input passed as a parameter to the script cgi-bin/connectedNodes.ovpl isn't "properly sanitized before being used as command line arguments." The resulting command "can be exploited to execute arbitrary shell commands via a specially crafted string containing shell meta characters."

The advisory also says the cdpView.ovpl, freeIPaddrs.ovpl, and ecscmg.ovpl scripts are reportedly also vulnerable.

Until HP releases a patch, the company advises users to move the connectedNodes.ovpl, cdpView.ovpl, freeIPaddrs.ovpl and ecscmg.ovpl scripts to another directory.

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter

By submitting your information, you agree that enterprisenetworkingplanet.com may send you ENTERPRISENetworkingPLANET offers via email, phone and text message, as well as email offers about other products and services that ENTERPRISENetworkingPLANET believes may be of interest to you. ENTERPRISENetworkingPLANET will process your information in accordance with the Quinstreet Privacy Policy.