Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against HP OpenView Network Node Manager HTTP Handling Buffer Overflow Vulnerability

Subscribe

Check Point Reference: CPAI-2008-112
Date Published:
Severity:
Last Updated:
Source: Secunia Advisory: SA29641
Industry Reference(s): CVE-2008-1697
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
HP OpenView Network Node Manager 7.51
Vulnerability Description
A buffer overflow vulnerability has been discovered in HP OpenView Network Node Manager. The Network Node Manager (NNM) is an HP OpenView product which manages networks. It determines and displays physical and logical connectivity in networks, as well as information referring to protocols running over the network. A remote attacker may exploit this issue to execute arbitrary code on a vulnerable system.
Vulnerability Details
The vulnerability is due to a boundary error in HP OpenView Network Node Manager that fails to properly process overly long HTTP GET requests. In order to exploit this vulnerability, an attacker can send a specially crafted HTTP request to a vulnerable host. Successful exploitation may allow the attacker to inject and execute arbitrary code on the target system.

Protection Overview
By enabling this protection, IPS-1 will detect and block crafted HTTP requests sent to the vulnerable server.

In order for the protection to be activated, update your product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > WWW 2, and select the CGI Attacks protection group.
3. Click HP OpenView Network Node Manager HTTP Handling Buffer Overflow (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entry will be logged:

Alert Name: www2_cgi
Description: www_cgi_cve_2008_1697_alert