PT-2009-1245 · Hewlett Packard · Hp Openview Network Node Manager

Published 2009-02-08 · Updated 2019-10-09 · CVE-2008-4560

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HP OpenView Network Node Manager (OV NNM) versions 7.01, 7.51, and 7.53

Description The issue allows remote attackers to obtain sensitive information. This can be achieved through a crafted request to the nnmRptConfig.exe CGI program, which reveals the pathname of log directories, or through a crafted parameter in a request to the ovlaunch.exe CGI program, which reveals configuration details.

Recommendations For HP OpenView Network Node Manager (OV NNM) version 7.01, consider restricting access to the nnmRptConfig.exe and ovlaunch.exe CGI programs until a fix is available. For HP OpenView Network Node Manager (OV NNM) version 7.51, consider restricting access to the nnmRptConfig.exe and ovlaunch.exe CGI programs until a fix is available. For HP OpenView Network Node Manager (OV NNM) version 7.53, consider restricting access to the nnmRptConfig.exe and ovlaunch.exe CGI programs until a fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-4560

Affected Products

Hp Openview Network Node Manager

References · 3

• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4560 · Security Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=771 · Note