TippingPoint Digital Vaccine Laboratories
DID YOU KNOW... In December of 2007, Microsoft released seven security bulletins which fixed 11 new security vulnerabilities. TippingPoint and ZDI were credited with discovering a total of four of those vulnerabilities.

HP OpenView Client Configuration Manager Device Code Execution Vulnerability

TPTI-06-13: November 8th, 2006


Affected Vendors

Affected Products

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on
vulnerable device installations of HP OpenView Client Configuraton Manager (CCM). Authentication is not required to exploit this vulnerability. The CCM server is not affected.

The specific flaw exists within the Radia Notify Daemon, radexecd.exe, which binds to TCP port 3465 on default CCM device installs. The vulnerable daemon expects to receive data in the following format:


Where 'port' specifies a connect back port on the connecting client. Due to a design flaw a correct username and password is not required in order to execute arbitrary commands within the radexecd.exe install directory. This exposes at least two pre-authentication issues. The first, allows attackers to reboot affected devices by launching radbootw.exe, which reboots the system without any further prompts. The second, allows attackers to generate an arbitrary file by launching radcrecv.exe. radcrecv will listen to an arbitrary port as specified on the command line and receive files via multicast download. The filename and contents can be specified by the attacker and is saved to the same directory as radexecd.exe. Once a malicious file has been generated, it can then be launched as before.

Vendor Response

Hewlett-Packard has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2006-10-10 - Vulnerability reported to vendor
    2006-11-08 - Coordinated public release of advisory


This vulnerability was discovered by: