Vulnerabilities > CVE-2011-0267 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in HP Openview Network Node Manager 7.51/7.53

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
hp
CWE-119
critical
nessus
exploit available
metasploit

Summary

Multiple buffer overflows in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allow remote attackers to execute arbitrary code via a long (1) schdParams or (2) nameParams parameter, a different vulnerability than CVE-2011-0266.

Vulnerable Configurations

Part Description Count
Application
Hp
2

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

description"HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow". CVE-2011-0267. Remote exploit for windows platform
fileexploits/windows/remote/17038.rb
idEDB-ID:17038
last seen2016-02-02
modified2011-03-24
platformwindows
port80
published2011-03-24
reportermetasploit
sourcehttps://www.exploit-db.com/download/17038/
titleHP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow
typeremote

Metasploit

descriptionThis module exploits NNM's nnmRptConfig.exe. Similar to other NNM CGI bugs, the overflow occurs during a ov.sprintf_new() call, which allows an attacker to overwrite data on the stack, and gain arbitrary code execution.
idMSF:EXPLOIT/WINDOWS/HTTP/HP_NNM_NNMRPTCONFIG_SCHDPARAMS
last seen2020-05-21
modified2017-07-24
published2011-03-23
referenceshttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0267
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/http/hp_nnm_nnmrptconfig_schdparams.rb
titleHP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow

Nessus

  • NASL familyCGI abuses
    NASL idOPENVIEW_NNM_EXECVP_NC.NASL
    descriptionThe version of HP OpenView Network Node Manager installed on the remote Windows host contains several vulnerabilities that can be exploited remotely to allow execution of arbitrary code within the context of the affected web server userid.
    last seen2020-06-01
    modified2020-06-02
    plugin id51645
    published2011-01-21
    reporterThis script is Copyright (C) 2011-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/51645
    titleHP OpenView Network Node Manager Remote Execution of Arbitrary Code (HPSBMA02621 SSRT100352)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(51645);
      script_version("1.13");
      script_cvs_date("Date: 2018/11/15 20:50:18");
    
      script_cve_id("CVE-2010-2703", "CVE-2011-0261", "CVE-2011-0262", "CVE-2011-0263",
                    "CVE-2011-0264", "CVE-2011-0265", "CVE-2011-0266", "CVE-2011-0267",
                    "CVE-2011-0268", "CVE-2011-0269", "CVE-2011-0270", "CVE-2011-0271");
      script_bugtraq_id(41829,45762);
      script_xref(name:"EDB-ID", value:"17028");
      script_xref(name:"EDB-ID", value:"17038");
    
      script_name(english:"HP OpenView Network Node Manager Remote Execution of Arbitrary Code (HPSBMA02621 SSRT100352)");
      script_summary(english:"Tries to overflow execvp_nc() buffer in webappmon.exe");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote web server contains a CGI application that allows remote
    code execution.");
      script_set_attribute(attribute:"description", value:
    "The version of HP OpenView Network Node Manager installed on the remote
    Windows host contains several vulnerabilities that can be exploited
    remotely to allow execution of arbitrary code within the context of the
    affected web server userid.");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-003/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-004/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-005/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-006/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-007/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-008/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-009/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-010/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-010/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-011/");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-012/");
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3ae2c3f5");
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5e3effcb");
      script_set_attribute(attribute:"solution", value:"Apply patch NNM_01208 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/07/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2011/01/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/01/21");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_end_attributes();
    
      script_category(ACT_ATTACK);
      script_family(english:"CGI abuses");
      script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");
    
      script_dependencies("http_version.nasl");
      script_exclude_keys("Settings/disable_cgi_scanning");
      script_require_ports("Services/www", 80);
    
      exit(0);
    }
    
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    
    
    port = get_http_port(default:80, embedded: 0);
    
    url     = '/OvCgi/webappmon.exe';
    params  = 'ins=nowait&sel=localhost&act=ping';
    
    # make sure NNM is running
    w = http_send_recv3(method:'GET', item:url + '?' + params, port:port,exit_on_fail:TRUE);
    if (
      w[0] !~ '^HTTP/1.[01][ \t]+200' ||
      w[2] !~ '<title>ping</title>'   || 
      w[2] !~ 'webappmon.exe'
    )  exit(0, "The web server on port "+port+" does not appear to be OpenView NNM for Windows.");
    
    # now do buffer overflow
    nodename = crap(data:'A',length:0x4000);
    data = 'ins=nowait&sel=' + nodename + '&act=ping';
    w = http_send_recv3(method:'POST', item:url,port:port,exit_on_fail:TRUE,
                        content_type:"application/x-www-form-urlencoded", data:data);
    
    res = w[2];
    
    if(isnull(res)) exit(0,"The response from OpenView NNM for Windows on port "+port+" does not have an HTTP response body.");
    
    
    # buffer overflow causes webappmon.exe to die
    if ('Error in CGI Application' >< res) security_hole(port);
    # patched version uses strncat() to truncate user-controlled data
    # what's sent will be reflected in return
    # text after Ping is somewhat truncated, possibly because the 0x4000-byte buffer also holds
    # standard output and error pipe names and other info
    else if ('sel=' + nodename >< res && res =~ 'Ping : A{10000,}') exit(0, "The OpenView NNM for Windows install on port "+port+" is not affected.");
    # unexpected return
    else exit(0, "Unexpected response ("+res+") received from the OpenView NNM for Windows install on port "+port+".");
    
  • NASL familyHP-UX Local Security Checks
    NASL idHPUX_PHSS_41607.NASL
    descriptions700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28 : The remote HP-UX host is affected by multiple vulnerabilities : - Potential security vulnerabilities have been identified with HP OpenView Network Node Manager (OV NNM). The vulnerabilities could be exploited remotely to execute arbitrary code under the context of the user running the web server. References: CVE-2011-0261 (ZDI-CAN-753) CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774) CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931) CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933) CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935) CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense). (HPSBMA02621 SSRT100352) - A potential vulnerability has been identified with HP OpenView Network Node Manager (OV NNM) running on Windows. The vulnerability could be exploited remotely to execute arbitrary code. References: CVE-2010-2703, ZDI-CAN-682. (HPSBMA02557 SSRT100025)
    last seen2020-06-01
    modified2020-06-02
    plugin id56844
    published2012-03-06
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/56844
    titleHP-UX PHSS_41607 : s700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and patch checks in this plugin were 
    # extracted from HP patch PHSS_41607. The text itself is
    # copyright (C) Hewlett-Packard Development Company, L.P.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(56844);
      script_version("1.10");
      script_cvs_date("Date: 2018/07/12 19:01:15");
    
      script_cve_id("CVE-2010-2703", "CVE-2011-0261", "CVE-2011-0262", "CVE-2011-0263", "CVE-2011-0264", "CVE-2011-0265", "CVE-2011-0266", "CVE-2011-0267", "CVE-2011-0268", "CVE-2011-0269", "CVE-2011-0270", "CVE-2011-0271");
      script_bugtraq_id(41829);
      script_xref(name:"HP", value:"emr_na-c02286088");
      script_xref(name:"HP", value:"emr_na-c02670501");
      script_xref(name:"HP", value:"SSRT100025");
      script_xref(name:"HP", value:"SSRT100352");
    
      script_name(english:"HP-UX PHSS_41607 : s700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28");
      script_summary(english:"Checks for the patch in the swlist output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote HP-UX host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "s700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28 : 
    
    The remote HP-UX host is affected by multiple vulnerabilities :
    
      - Potential security vulnerabilities have been identified
        with HP OpenView Network Node Manager (OV NNM). The
        vulnerabilities could be exploited remotely to execute
        arbitrary code under the context of the user running the
        web server. References: CVE-2011-0261 (ZDI-CAN-753)
        CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774)
        CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931)
        CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933)
        CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935)
        CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense).
        (HPSBMA02621 SSRT100352)
    
      - A potential vulnerability has been identified with HP
        OpenView Network Node Manager (OV NNM) running on
        Windows. The vulnerability could be exploited remotely
        to execute arbitrary code. References: CVE-2010-2703,
        ZDI-CAN-682. (HPSBMA02557 SSRT100025)"
      );
      # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?dae68cca"
      );
      # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02670501
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?5e3effcb"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Install patch PHSS_41607 or subsequent."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:hp:hp-ux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/12/20");
      script_set_attribute(attribute:"patch_modification_date", value:"2011/01/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/06");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
      script_family(english:"HP-UX Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/HP-UX/version", "Host/HP-UX/swlist");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("hpux.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/HP-UX/version")) audit(AUDIT_OS_NOT, "HP-UX");
    if (!get_kb_item("Host/HP-UX/swlist")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    if (!hpux_check_ctx(ctx:"11.23 11.31", proc:"ia64"))
    {
      exit(0, "The host is not affected since PHSS_41607 applies to a different OS release / architecture.");
    }
    
    patches = make_list("PHSS_41607", "PHSS_41858", "PHSS_42233", "PHSS_43047", "PHSS_43354");
    foreach patch (patches)
    {
      if (hpux_installed(app:patch))
      {
        exit(0, "The host is not affected because patch "+patch+" is installed.");
      }
    }
    
    
    flag = 0;
    if (hpux_check_patch(app:"OVNNMgrRtDOC.OVNNM-KOR-DOC", version:"B.07.50.00")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:hpux_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyHP-UX Local Security Checks
    NASL idHPUX_PHSS_41606.NASL
    descriptions700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28 : The remote HP-UX host is affected by multiple vulnerabilities : - A potential vulnerability has been identified with HP OpenView Network Node Manager (OV NNM) running on Windows. The vulnerability could be exploited remotely to execute arbitrary code. References: CVE-2010-2703, ZDI-CAN-682. (HPSBMA02557 SSRT100025) - Potential security vulnerabilities have been identified with HP OpenView Network Node Manager (OV NNM). The vulnerabilities could be exploited remotely to execute arbitrary code under the context of the user running the web server. References: CVE-2011-0261 (ZDI-CAN-753) CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774) CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931) CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933) CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935) CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense). (HPSBMA02621 SSRT100352)
    last seen2020-06-01
    modified2020-06-02
    plugin id56843
    published2012-03-06
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/56843
    titleHP-UX PHSS_41606 : s700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and patch checks in this plugin were 
    # extracted from HP patch PHSS_41606. The text itself is
    # copyright (C) Hewlett-Packard Development Company, L.P.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(56843);
      script_version("1.10");
      script_cvs_date("Date: 2018/07/12 19:01:15");
    
      script_cve_id("CVE-2010-2703", "CVE-2011-0261", "CVE-2011-0262", "CVE-2011-0263", "CVE-2011-0264", "CVE-2011-0265", "CVE-2011-0266", "CVE-2011-0267", "CVE-2011-0268", "CVE-2011-0269", "CVE-2011-0270", "CVE-2011-0271");
      script_bugtraq_id(41829);
      script_xref(name:"HP", value:"emr_na-c02286088");
      script_xref(name:"HP", value:"emr_na-c02670501");
      script_xref(name:"HP", value:"SSRT100025");
      script_xref(name:"HP", value:"SSRT100352");
    
      script_name(english:"HP-UX PHSS_41606 : s700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28");
      script_summary(english:"Checks for the patch in the swlist output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote HP-UX host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "s700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28 : 
    
    The remote HP-UX host is affected by multiple vulnerabilities :
    
      - A potential vulnerability has been identified with HP
        OpenView Network Node Manager (OV NNM) running on
        Windows. The vulnerability could be exploited remotely
        to execute arbitrary code. References: CVE-2010-2703,
        ZDI-CAN-682. (HPSBMA02557 SSRT100025)
    
      - Potential security vulnerabilities have been identified
        with HP OpenView Network Node Manager (OV NNM). The
        vulnerabilities could be exploited remotely to execute
        arbitrary code under the context of the user running the
        web server. References: CVE-2011-0261 (ZDI-CAN-753)
        CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774)
        CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931)
        CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933)
        CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935)
        CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense).
        (HPSBMA02621 SSRT100352)"
      );
      # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?dae68cca"
      );
      # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02670501
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?5e3effcb"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Install patch PHSS_41606 or subsequent."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:hp:hp-ux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/12/20");
      script_set_attribute(attribute:"patch_modification_date", value:"2011/01/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/06");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
      script_family(english:"HP-UX Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/HP-UX/version", "Host/HP-UX/swlist");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("hpux.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/HP-UX/version")) audit(AUDIT_OS_NOT, "HP-UX");
    if (!get_kb_item("Host/HP-UX/swlist")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    if (!hpux_check_ctx(ctx:"11.11 11.23 11.31", proc:"parisc"))
    {
      exit(0, "The host is not affected since PHSS_41606 applies to a different OS release / architecture.");
    }
    
    patches = make_list("PHSS_41606", "PHSS_41857", "PHSS_42232", "PHSS_43046", "PHSS_43353");
    foreach patch (patches)
    {
      if (hpux_installed(app:patch))
      {
        exit(0, "The host is not affected because patch "+patch+" is installed.");
      }
    }
    
    
    flag = 0;
    if (hpux_check_patch(app:"OVNNMgrRtDOC.OVNNM-KOR-DOC", version:"B.07.50.00")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:hpux_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/99675/hp_nnm_nnmrptconfig_schdparams.rb.txt
idPACKETSTORM:99675
last seen2016-12-05
published2011-03-24
reportersinn3r
sourcehttps://packetstormsecurity.com/files/99675/HP-OpenView-NNM-nnmRptConfig.exe-schdParams-Buffer-Overflow.html
titleHP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow

Saint

  • bid45762
    descriptionHP OpenView Network Node Manager nnmRptConfig.exe schd_select1 Remote Code Execution
    idnet_ovnodemgrnnmrptconfigbo
    osvdb70473
    titleopenview_nnm_nnmrptconfig_schdselect
    typeremote
  • bid45762
    descriptionHP OpenView Network Node Manager malformed displayWidth option to jovgraph.exe
    idnet_ovnodemgrnnmrptconfigbo
    osvdb70469
    titleopenview_nnm_jovgraph_displaywidth
    typeremote
  • bid45762
    descriptionHP OpenView Network Node Manager ovwebsnmpsrv.exe ovutil.dll stringToSeconds Buffer Overflow
    idnet_ovnodemgrnnmrptconfigbo
    osvdb70470
    titleopenview_nnm_ovwebsnmpsrv_stringtoseconds
    typeremote
  • bid45762
    descriptionHP OpenView Network Node Manager nnmRptConfig.exe nameParams text1 Buffer Overflow
    idnet_ovnodemgrnnmrptconfigbo
    osvdb70473
    titleopenview_nnm_nnmrptconfig_nameparams
    typeremote