HP OpenView NNM OvWebHelp.exe CGI Topic Heap Overflow VulnerabilityTPTI-09-11: December 9th, 2009
TippingPoint™ IPS Customer ProtectionTippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 8354. For further product information on the TippingPoint IPS:
Vulnerability DetailsThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard OpenView Network Node Manager. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the OvWebHelp.exe CGI application. During a string concatenation the process takes the value of the Topic POST variable and copies it without any length checks into a static 0x400 byte heap buffer. By providing a large enough string this buffer can be overrun leading to arbitrary code execution.
Vendor ResponseHewlett-Packard has issued an update to correct this vulnerability. More details can be found at:
2009-07-20 - Vulnerability reported to vendor
2009-12-09 - Coordinated public release of advisory