Vulnerabilities > CVE-2010-2703 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in HP Openview Network Node Manager 7.51/7.53

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
hp
microsoft
CWE-119
critical
nessus
exploit available
metasploit
NVD
Published: 2010-07-28
Updated: 2018-10-10

Summary

Stack-based buffer overflow in the execvp_nc function in the ov.dll module in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when running on Windows, allows remote attackers to execute arbitrary code via a long HTTP request to webappmon.exe.

Vulnerable Configurations

Part Description Count
Application
Hp
2
OS
Microsoft
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

  • descriptionHP NNM CGI webappmon.exe execvp Buffer Overflow. CVE-2010-2703. Remote exploit for windows platform
    idEDB-ID:17030
    last seen2016-02-02
    modified2011-03-23
    published2011-03-23
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/17030/
    titleHP NNM CGI webappmon.exe execvp Buffer Overflow
  • descriptionMOAUB #6 - HP OpenView NNM webappmon.exe execvp_nc Remote Code Execution. CVE-2010-2703. Dos exploit for windows platform
    fileexploits/windows/dos/14916.py
    idEDB-ID:14916
    last seen2016-02-01
    modified2010-09-06
    platformwindows
    port
    published2010-09-06
    reporterAbysssec
    sourcehttps://www.exploit-db.com/download/14916/
    titleHP OpenView NNM - webappmon.exe execvp_nc Remote Code Execution
    typedos

Metasploit

descriptionThis module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01207 or NNM_01206 without the SSRT100025 hotfix. By specifying a long 'sel' parameter when calling methods within the 'webappmon.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. This vulnerability is not triggerable via a GET request due to limitations on the request size. The buffer being targeted is 16384 bytes in size. There are actually two adjacent buffers that both get overflowed (one into the other), and strcat is used. The vulnerable code is within the "execvp_nc" function within "ov.dll" prior to v 1.30.12.69. There are no stack cookies, so exploitation is easily achieved by overwriting the saved return address or SEH frame. This vulnerability might also be triggerable via other CGI programs, however this was not fully investigated.
idMSF:EXPLOIT/WINDOWS/HTTP/HP_NNM_WEBAPPMON_EXECVP
last seen2020-05-26
modified2017-09-14
published2011-03-23
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb
titleHP OpenView Network Node Manager execvp_nc Buffer Overflow

Nessus

  • NASL familyCGI abuses
    NASL idOPENVIEW_NNM_EXECVP_NC.NASL
    descriptionThe version of HP OpenView Network Node Manager installed on the remote Windows host contains several vulnerabilities that can be exploited remotely to allow execution of arbitrary code within the context of the affected web server userid.
    last seen2020-06-01
    modified2020-06-02
    plugin id51645
    published2011-01-21
    reporterThis script is Copyright (C) 2011-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/51645
    titleHP OpenView Network Node Manager Remote Execution of Arbitrary Code (HPSBMA02621 SSRT100352)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(51645);
  script_version("1.13");
  script_cvs_date("Date: 2018/11/15 20:50:18");

  script_cve_id("CVE-2010-2703", "CVE-2011-0261", "CVE-2011-0262", "CVE-2011-0263",
                "CVE-2011-0264", "CVE-2011-0265", "CVE-2011-0266", "CVE-2011-0267",
                "CVE-2011-0268", "CVE-2011-0269", "CVE-2011-0270", "CVE-2011-0271");
  script_bugtraq_id(41829,45762);
  script_xref(name:"EDB-ID", value:"17028");
  script_xref(name:"EDB-ID", value:"17038");

  script_name(english:"HP OpenView Network Node Manager Remote Execution of Arbitrary Code (HPSBMA02621 SSRT100352)");
  script_summary(english:"Tries to overflow execvp_nc() buffer in webappmon.exe");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server contains a CGI application that allows remote
code execution.");
  script_set_attribute(attribute:"description", value:
"The version of HP OpenView Network Node Manager installed on the remote
Windows host contains several vulnerabilities that can be exploited
remotely to allow execution of arbitrary code within the context of the
affected web server userid.");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-003/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-004/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-005/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-006/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-007/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-008/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-009/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-010/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-010/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-011/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-012/");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3ae2c3f5");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5e3effcb");
  script_set_attribute(attribute:"solution", value:"Apply patch NNM_01208 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/07/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/01/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"CGI abuses");
  script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");

  script_dependencies("http_version.nasl");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("global_settings.inc");
include("misc_func.inc");
include("http.inc");


port = get_http_port(default:80, embedded: 0);

url     = '/OvCgi/webappmon.exe';
params  = 'ins=nowait&sel=localhost&act=ping';

# make sure NNM is running
w = http_send_recv3(method:'GET', item:url + '?' + params, port:port,exit_on_fail:TRUE);
if (
  w[0] !~ '^HTTP/1.[01][ \t]+200' ||
  w[2] !~ '<title>ping</title>'   || 
  w[2] !~ 'webappmon.exe'
)  exit(0, "The web server on port "+port+" does not appear to be OpenView NNM for Windows.");

# now do buffer overflow
nodename = crap(data:'A',length:0x4000);
data = 'ins=nowait&sel=' + nodename + '&act=ping';
w = http_send_recv3(method:'POST', item:url,port:port,exit_on_fail:TRUE,
                    content_type:"application/x-www-form-urlencoded", data:data);

res = w[2];

if(isnull(res)) exit(0,"The response from OpenView NNM for Windows on port "+port+" does not have an HTTP response body.");


# buffer overflow causes webappmon.exe to die
if ('Error in CGI Application' >< res) security_hole(port);
# patched version uses strncat() to truncate user-controlled data
# what's sent will be reflected in return
# text after Ping is somewhat truncated, possibly because the 0x4000-byte buffer also holds
# standard output and error pipe names and other info
else if ('sel=' + nodename >< res && res =~ 'Ping : A{10000,}') exit(0, "The OpenView NNM for Windows install on port "+port+" is not affected.");
# unexpected return
else exit(0, "Unexpected response ("+res+") received from the OpenView NNM for Windows install on port "+port+".");
  • NASL familyHP-UX Local Security Checks
    NASL idHPUX_PHSS_41607.NASL
    descriptions700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28 : The remote HP-UX host is affected by multiple vulnerabilities : - Potential security vulnerabilities have been identified with HP OpenView Network Node Manager (OV NNM). The vulnerabilities could be exploited remotely to execute arbitrary code under the context of the user running the web server. References: CVE-2011-0261 (ZDI-CAN-753) CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774) CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931) CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933) CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935) CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense). (HPSBMA02621 SSRT100352) - A potential vulnerability has been identified with HP OpenView Network Node Manager (OV NNM) running on Windows. The vulnerability could be exploited remotely to execute arbitrary code. References: CVE-2010-2703, ZDI-CAN-682. (HPSBMA02557 SSRT100025)
    last seen2020-06-01
    modified2020-06-02
    plugin id56844
    published2012-03-06
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/56844
    titleHP-UX PHSS_41607 : s700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and patch checks in this plugin were 
# extracted from HP patch PHSS_41607. The text itself is
# copyright (C) Hewlett-Packard Development Company, L.P.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(56844);
  script_version("1.10");
  script_cvs_date("Date: 2018/07/12 19:01:15");

  script_cve_id("CVE-2010-2703", "CVE-2011-0261", "CVE-2011-0262", "CVE-2011-0263", "CVE-2011-0264", "CVE-2011-0265", "CVE-2011-0266", "CVE-2011-0267", "CVE-2011-0268", "CVE-2011-0269", "CVE-2011-0270", "CVE-2011-0271");
  script_bugtraq_id(41829);
  script_xref(name:"HP", value:"emr_na-c02286088");
  script_xref(name:"HP", value:"emr_na-c02670501");
  script_xref(name:"HP", value:"SSRT100025");
  script_xref(name:"HP", value:"SSRT100352");

  script_name(english:"HP-UX PHSS_41607 : s700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28");
  script_summary(english:"Checks for the patch in the swlist output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote HP-UX host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"s700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28 : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - Potential security vulnerabilities have been identified
    with HP OpenView Network Node Manager (OV NNM). The
    vulnerabilities could be exploited remotely to execute
    arbitrary code under the context of the user running the
    web server. References: CVE-2011-0261 (ZDI-CAN-753)
    CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774)
    CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931)
    CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933)
    CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935)
    CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense).
    (HPSBMA02621 SSRT100352)

  - A potential vulnerability has been identified with HP
    OpenView Network Node Manager (OV NNM) running on
    Windows. The vulnerability could be exploited remotely
    to execute arbitrary code. References: CVE-2010-2703,
    ZDI-CAN-682. (HPSBMA02557 SSRT100025)"
  );
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?dae68cca"
  );
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02670501
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5e3effcb"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Install patch PHSS_41607 or subsequent."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hp:hp-ux");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/12/20");
  script_set_attribute(attribute:"patch_modification_date", value:"2011/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/06");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
  script_family(english:"HP-UX Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/HP-UX/version", "Host/HP-UX/swlist");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("hpux.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/HP-UX/version")) audit(AUDIT_OS_NOT, "HP-UX");
if (!get_kb_item("Host/HP-UX/swlist")) audit(AUDIT_PACKAGE_LIST_MISSING);

if (!hpux_check_ctx(ctx:"11.23 11.31", proc:"ia64"))
{
  exit(0, "The host is not affected since PHSS_41607 applies to a different OS release / architecture.");
}

patches = make_list("PHSS_41607", "PHSS_41858", "PHSS_42233", "PHSS_43047", "PHSS_43354");
foreach patch (patches)
{
  if (hpux_installed(app:patch))
  {
    exit(0, "The host is not affected because patch "+patch+" is installed.");
  }
}


flag = 0;
if (hpux_check_patch(app:"OVNNMgrRtDOC.OVNNM-KOR-DOC", version:"B.07.50.00")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:hpux_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familyHP-UX Local Security Checks
    NASL idHPUX_PHSS_41606.NASL
    descriptions700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28 : The remote HP-UX host is affected by multiple vulnerabilities : - A potential vulnerability has been identified with HP OpenView Network Node Manager (OV NNM) running on Windows. The vulnerability could be exploited remotely to execute arbitrary code. References: CVE-2010-2703, ZDI-CAN-682. (HPSBMA02557 SSRT100025) - Potential security vulnerabilities have been identified with HP OpenView Network Node Manager (OV NNM). The vulnerabilities could be exploited remotely to execute arbitrary code under the context of the user running the web server. References: CVE-2011-0261 (ZDI-CAN-753) CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774) CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931) CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933) CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935) CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense). (HPSBMA02621 SSRT100352)
    last seen2020-06-01
    modified2020-06-02
    plugin id56843
    published2012-03-06
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/56843
    titleHP-UX PHSS_41606 : s700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and patch checks in this plugin were 
# extracted from HP patch PHSS_41606. The text itself is
# copyright (C) Hewlett-Packard Development Company, L.P.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(56843);
  script_version("1.10");
  script_cvs_date("Date: 2018/07/12 19:01:15");

  script_cve_id("CVE-2010-2703", "CVE-2011-0261", "CVE-2011-0262", "CVE-2011-0263", "CVE-2011-0264", "CVE-2011-0265", "CVE-2011-0266", "CVE-2011-0267", "CVE-2011-0268", "CVE-2011-0269", "CVE-2011-0270", "CVE-2011-0271");
  script_bugtraq_id(41829);
  script_xref(name:"HP", value:"emr_na-c02286088");
  script_xref(name:"HP", value:"emr_na-c02670501");
  script_xref(name:"HP", value:"SSRT100025");
  script_xref(name:"HP", value:"SSRT100352");

  script_name(english:"HP-UX PHSS_41606 : s700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28");
  script_summary(english:"Checks for the patch in the swlist output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote HP-UX host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"s700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28 : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential vulnerability has been identified with HP
    OpenView Network Node Manager (OV NNM) running on
    Windows. The vulnerability could be exploited remotely
    to execute arbitrary code. References: CVE-2010-2703,
    ZDI-CAN-682. (HPSBMA02557 SSRT100025)

  - Potential security vulnerabilities have been identified
    with HP OpenView Network Node Manager (OV NNM). The
    vulnerabilities could be exploited remotely to execute
    arbitrary code under the context of the user running the
    web server. References: CVE-2011-0261 (ZDI-CAN-753)
    CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774)
    CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931)
    CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933)
    CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935)
    CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense).
    (HPSBMA02621 SSRT100352)"
  );
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?dae68cca"
  );
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02670501
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5e3effcb"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Install patch PHSS_41606 or subsequent."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hp:hp-ux");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/12/20");
  script_set_attribute(attribute:"patch_modification_date", value:"2011/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/06");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
  script_family(english:"HP-UX Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/HP-UX/version", "Host/HP-UX/swlist");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("hpux.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/HP-UX/version")) audit(AUDIT_OS_NOT, "HP-UX");
if (!get_kb_item("Host/HP-UX/swlist")) audit(AUDIT_PACKAGE_LIST_MISSING);

if (!hpux_check_ctx(ctx:"11.11 11.23 11.31", proc:"parisc"))
{
  exit(0, "The host is not affected since PHSS_41606 applies to a different OS release / architecture.");
}

patches = make_list("PHSS_41606", "PHSS_41857", "PHSS_42232", "PHSS_43046", "PHSS_43353");
foreach patch (patches)
{
  if (hpux_installed(app:patch))
  {
    exit(0, "The host is not affected because patch "+patch+" is installed.");
  }
}


flag = 0;
if (hpux_check_patch(app:"OVNNMgrRtDOC.OVNNM-KOR-DOC", version:"B.07.50.00")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:hpux_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

Packetstorm

Seebug

bulletinFamilyexploit
descriptionNo description provided by source.
idSSV:69790
last seen2017-11-19
modified2014-07-01
published2014-07-01
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-69790
titleHP OpenView NNM - webappmon.exe execvp_nc Remote Code Execution

References