Check Point Advisories

HP OpenView Network Node Manager Remote Command Execution (CVE-2005-2773)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-284
Date Published:	6 Oct 2009
Severity:	Critical
Last Updated:	Sunday 19 April, 2015
Source:
Industry Reference:	CVE-2005-2773
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	HP OpenView Network Node Manager (NNM) is a solution for the management, maintenance and monitoring of networks and network devices. It is capable of discovering network devices and illustrating the structure of the network in a graphical format. The software suite also identifies possible network trouble spots and failed devices. HP NNM provides a web interface that allows a network administrator to perform numerous administrative functions from a remote location. There exists a command execution vulnerability in HP OpenView Network Node Manager. The vulnerability exists as a result of several CGI scripts failing to properly sanitize user provided parameters. An attacker can exploit the vulnerability to execute arbitrary system commands in the context of the currently running web service. The vulnerability can be triggered remotely without credentials by sending specially crafted HTTP requests to the target system. A successful attack can let non-privileged users execute system command in the security context of the affected process. The behaviour of the target system is dependent on the nature of the injected code. By default, the vulnerable product runs as the System user on Windows systems, and the bin user on Unix-like systems.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the HP OpenView Network Node Manager Remote Command Execution protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: HP Products Protection Violation.
Attack Information: HP OpenView Network Node Manager remote command execution