PT-2011-2250 · Hewlett Packard · Hp Openview Performance Insight Server

Stephen Fewer · Published 2011-01-31 · Updated 2018-10-10 · CVE-2011-0276

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP OpenView Performance Insight Server versions 5.2 through 5.41

Description The issue concerns a hidden account in the com.trinagy.security.XMLUserManager Java class, allowing remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet class.

Recommendations For HP OpenView Performance Insight Server versions 5.2 through 5.41, consider disabling the com.trinagy.servlet.HelpManagerServlet class until a patch is available to prevent exploitation of the hidden account. Restrict access to the com.trinagy.security.XMLUserManager Java class to minimize the risk of arbitrary code execution.

Exploit

Fix

Related Identifiers

CVE-2011-0276

ZDI-11-034

Affected Products

Hp Openview Performance Insight Server

References · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_openview_insight_backdoor.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16984 · Exploit
• 🔥 http://exploit-db.com/exploits/16984 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-11-034 · Security Note
• http://vupen.com/english/advisories/2011/0258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0276 · Security Note
• http://secunia.com/advisories/43145 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02695453 · Vendor Advisory
• http://securityreason.com/securityalert/8136 · Note
• http://securityfocus.com/archive/1/516093/100/0/threaded · Note
• http://securityfocus.com/bid/46079 · Note
• http://osvdb.org/70754 · Note
• http://securitytracker.com/id?1025014 · Note
• http://zerodayinitiative.com/advisories/ZDI-11-034 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65038 · Note