|
|
|
|
| |
Credit:
The information has been provided by iDefense Labs.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=770
|
| |
Vulnerable Systems:
* HP Network Node Manager version 7.53 for Linux
Multiple command injection vulnerabilities are present in NNM CGI applications.
The vulnerabilities are very similar and occur in the webappmon.exe and OpenView5.exe program. Part of the functionality of these applications is to start other programs and collect their output. In order to perform this, they each execute external programs along with any attacker controllable arguments for the application. The arguments may contain shell meta-characters. This allows an attacker to run arbitrary shell commands. The arguments are not filtered before being passed to the external program. This results in attacker supplied commands being run on the host.
Analysis:
Exploitation of these vulnerabilities results in the execution of arbitrary code with the privileges of the affected service. On RedHat Enterprise 4, the application is started as the user 'bin'. All that is required for exploitation is the ability to create a TCP connection to port 80 on the targeted host.
Workaround:
By default, the NNM CGI applications do not require a user to be authenticated. By changing the session.conf file and setting UserLogin to ON, it is possible to require valid credentials in order to run. The 'ovhtpasswd' application can then be used to add valid credentials to the password file.
Vendor response:
HP has released a patch which addresses this issue. For more information, consult their advisory at the following URL.
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610
CVE Information:
CVE-2008-4559
Disclosure timeline:
06/19/2008 - Initial Contact
06/19/2008 - Vendor Case numbers set
07/10/2008 - PoC sent
01/22/2009 - Vendor says patch is ready
02/05/2009 - Requested CVE from vendor
02/05/2009 - Requested date coordination
02/06/2009 - Coordinated Public Disclosure
|
|
|
|
|
