National Cyber Awareness System

Vulnerability Summary for CVE-2009-3849

Overview

Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long Template parameter to nnmRptConfig.exe, related to the strcat function; or (2) a long Oid parameter to snmp.exe.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: HP

Name: HPSBMA02483

Type: Advisory; Patch Information

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877

External Source: HP

Name: HPSBMA02483

Type: Advisory; Patch Information

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877

External Source: MISC

Name: http://zerodayinitiative.com/advisories/ZDI-09-097/

Hyperlink:http://zerodayinitiative.com/advisories/ZDI-09-097/

External Source: MISC

Name: http://zerodayinitiative.com/advisories/ZDI-09-095/

Hyperlink:http://zerodayinitiative.com/advisories/ZDI-09-095/

External Source: XF

Name: hp-openviewnnm-snmp-bo(54654)

Hyperlink:http://xforce.iss.net/xforce/xfdb/54654

External Source: XF

Name: hp-ovnnm-nnmrptconfig-bo(54652)

Hyperlink:http://xforce.iss.net/xforce/xfdb/54652

External Source: BID

Name: 37299

Hyperlink:http://www.securityfocus.com/bid/37299

External Source: BID

Name: 37298

Hyperlink:http://www.securityfocus.com/bid/37298

External Source: BID

Name: 37261

Hyperlink:http://www.securityfocus.com/bid/37261

External Source: BUGTRAQ

Name: 20091209 ZDI-09-095: Hewlett-Packard OpenView NNM Snmp.exe Oid Variable Buffer Overflow Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/508349/100/0/threaded

External Source: BUGTRAQ

Name: 20091209 ZDI-09-097: Hewlett-Packard OpenView NNM nnmRptConfig.exe Template Variable strcat Overflow Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/508348/100/0/threaded

External Source: HP

Name: SSRT090257

Hyperlink:http://marc.info/?l=bugtraq&m=126046355120442&w=2