Sign-up

ID

VAR-200709-0354


CVE

CVE-2007-4720


TITLE

JP1/Cm2/Network Node Manager Arbitrary Code Execution Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2007-001092

DESCRIPTION

Unspecified vulnerability in the Shared Trace Service in Hitachi JP1/Cm2/Network Node Manager (NNM) 07-10 through 07-10-05, and NNM Starter Edition Enterprise and 250 08-00 through 08-10, allows remote attackers to execute arbitrary code via unspecified vectors. Hitachi JP1/CM2/Network Node Manager is prone to a code-execution vulnerability. Hitachi JP1/CM2/Network Node Manager 07-10 through 07-10-5, 08-00 through 08-00-03, and 08-10 are vulnerable. ---------------------------------------------------------------------- BETA test the new Secunia Personal Software Inspector! The Secunia PSI detects installed software on your computer and categorises it as either Insecure, End-of-Life, or Up-To-Date. Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors. Download the free PSI BETA from the Secunia website: https://psi.secunia.com/ ---------------------------------------------------------------------- TITLE: HP OpenView Products Shared Trace Service Buffer Overflow Vulnerabilities SECUNIA ADVISORY ID: SA26394 VERIFY ADVISORY: http://secunia.com/advisories/26394/ CRITICAL: Moderately critical IMPACT: System access WHERE: >From local network SOFTWARE: HP OpenView Performance Insight (OVPI) 5.x http://secunia.com/product/15212/ HP OpenView Dashboard 2.x http://secunia.com/product/15211/ HP OpenView Business Process Insight (OVBPI) 1.x http://secunia.com/product/15202/ HP OpenView Business Process Insight (OVBPI) 2.x http://secunia.com/product/15203/ HP OpenView Service Desk Process Insight (SDPI) 1.x http://secunia.com/product/15204/ HP OpenView Service Desk Process Insight (SDPI) 2.x http://secunia.com/product/15205/ HP Business Process Insight (HPBPI) 1.x http://secunia.com/product/15207/ HP Business Process Insight (HPBPI) 2.x http://secunia.com/product/15208/ HP Service Desk Process Insight (HPSDPI) 1.x http://secunia.com/product/15209/ HP Service Desk Process Insight (HPSDPI) 2.x http://secunia.com/product/15210/ HP OpenView Network Node Manager (NNM) 6.x http://secunia.com/product/2384/ HP OpenView Network Node Manager (NNM) 7.x http://secunia.com/product/3608/ HP OpenView Service Quality Manager (OV SQM) 1.x http://secunia.com/product/15200/ HP OpenView Operations Manager for Windows (OVOW) 7.x http://secunia.com/product/15199/ HP OpenView Operations HTTPS Agent 8.x http://secunia.com/product/8641/ HP OpenView Reporter 3.x http://secunia.com/product/15198/ HP OpenView Performance Agent http://secunia.com/product/2100/ HP OpenView Performance Manager (OVPM) 5.x http://secunia.com/product/15196/ HP OpenView Performance Manager (OVPM) 6.x http://secunia.com/product/15197/ HP OpenView Internet Service (OVIS) 6.x http://secunia.com/product/15195/ DESCRIPTION: Some vulnerabilities have been reported in HP OpenView products, which can be exploited by malicious people to compromise a vulnerable system. The vulnerabilities are caused due to boundary errors within the Shared Trace Service component when handling certain requests. These can be exploited to cause stack-based buffer overflows via sending specially crafted requests to the service. The vulnerabilities affect the following products and versions: * HP OpenView Internet Service (OVIS) v6.00, v6.10, v6.11 (Japanese), v6.20 running HP OpenView Cross Platform Component (XPL) vB.60.81.00, vB.60.90.00, and vB.61.90.000 * HP OpenView Performance Manager (OVPM) 5.x and 6.x * HP OpenView Performance Agent (OVPA) 4.5 and 4.6 * HP OpenView Reporter 3.7 * HP OpenView Operations (OVO) Agents OVO8.x HTTPS agents * HP OpenView Operations Manager for Windows (OVOW) v7.5 with the OpenView Operations (OVO) add on module for OpenView Operations-Business Availability Center (OVO-BAC) * HP OpenView Quality Manager (OV SQM) v1.2 SP1, v1.3, v1.40 running HP OpenView Cross Platform Component (XPL) 2.60.041, 2.61.060 and 2.61.110 * HP OpenView Network Node Manager (OV NNM) v6.41, v7.01, v7.50 running XPL earlier than 03.10.040 * HP OpenView Business Process Insight (OVBPI), HP Business Process Insight (HPBPI) , HP OpenView Service Desk Process Insight (SDPI), and HP Service Desk Process Insight (HPSDPI) versions 1.0, 1.1x, 2.0x and 2.10x * HP OpenView Dashboard v2.01 running HP OpenView Cross Platform Component (XPL) vB.60.90.00 and vB.61.90.000 * HP OpenView Performance Insight (OVPI) v5.0, v5.1, v5.1.1, v5.1.2, v5.2 running HP OpenView Cross Platform Component (XPL) earlier than v3.10.040 SOLUTION: Apply hotfixes. Please see the vendor's advisories for details. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Cody Pierce, TippingPoint DV Labs. 2) An anonymous researcher, reported via iDefense Labs. ORIGINAL ADVISORY: HPSBMA02235 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01106515 HPSBMA02236 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01109171 HPSBMA02237 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01109584 HPSBMA02238 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01109617 HPSBMA02239 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01110576 HPSBMA02240 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01110627 HPSBMA02241 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01111851 HPSBMA02242 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01112038 HPSBMA02244 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01114023 HPSBMA02245 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01114156 HPSBMA02246 SSRT061260: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01115068 iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=574 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . No further information is currently available. Please see the vendor's advisory for a list of affected products and versions

Trust: 2.07

sources: NVD: CVE-2007-4720 // JVNDB: JVNDB-2007-001092 // BID: 25520 // PACKETSTORM: 58426 // PACKETSTORM: 59014

AFFECTED PRODUCTS

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:07_10

Trust: 1.6

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:07_10_01

Trust: 1.6

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:08_00_03

Trust: 1.6

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:07_10_02

Trust: 1.6

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:08_00_10

Trust: 1.6

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:08_00_02

Trust: 1.6

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:08_00_01

Trust: 1.6

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:07_10_04

Trust: 1.0

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:08_00

Trust: 1.0

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:07_10_03

Trust: 1.0

vendor:hitachimodel:jp1 cm2 network node managerscope:eqversion:07_10_05

Trust: 1.0

vendor:hitachimodel:jp1/cm2/network node managerscope:eqversion:07-10-05

Trust: 0.9

vendor:hitachimodel:jp1/cm2/network node managerscope:eqversion:07-10-04

Trust: 0.9

vendor:hitachimodel:jp1/cm2/network node managerscope:eqversion:07-10-03

Trust: 0.9

vendor:hitachimodel:jp1/cm2/network node managerscope:eqversion:07-10-02

Trust: 0.9

vendor:hitachimodel:jp1/cm2/network node managerscope:eqversion:07-10-01

Trust: 0.9

vendor:hitachimodel:jp1/cm2/network node managerscope:eqversion:07-10

Trust: 0.9

vendor:hitachimodel:jp1/cm2/network node managerscope: - version: -

Trust: 0.8

vendor:hitachimodel:jp1/cm2/network node managerscope:eqversion:starter edition 250

Trust: 0.8

vendor:hitachimodel:jp1/cm2/network node managerscope:eqversion:starter edition enterprise

Trust: 0.8

vendor:hitachimodel:jp1/cm2/network node manager start editionscope:eqversion:08-00-10

Trust: 0.3

vendor:hitachimodel:jp1/cm2/network node manager start editionscope:eqversion:08-00-03

Trust: 0.3

vendor:hitachimodel:jp1/cm2/network node manager start editionscope:eqversion:08-00-02

Trust: 0.3

vendor:hitachimodel:jp1/cm2/network node manager start editionscope:eqversion:08-00-01

Trust: 0.3

vendor:hitachimodel:jp1/cm2/network node manager start editionscope:eqversion:08-00

Trust: 0.3

sources: BID: 25520 // JVNDB: JVNDB-2007-001092 // CNNVD: CNNVD-200709-046 // NVD: CVE-2007-4720

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-4720
value: MEDIUM

Trust: 1.0

IPA: JVNDB-2007-001092
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200709-046
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2007-4720
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

IPA: JVNDB-2007-001092
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

sources: JVNDB: JVNDB-2007-001092 // CNNVD: CNNVD-200709-046 // NVD: CVE-2007-4720

PROBLEMTYPE DATA

problemtype:CWE-94

Trust: 1.8

sources: JVNDB: JVNDB-2007-001092 // NVD: CVE-2007-4720

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200709-046

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-200709-046

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2007-001092

PATCH
title:HS07-030url:http://www.hitachi-support.com/security_e/vuls_e/HS07-030_e/index-e.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2007-001092

EXTERNAL IDS
db:NVDid:CVE-2007-4720
Trust: 2.7
db:BIDid:25520
Trust: 2.7
db:SECUNIAid:26668
Trust: 2.6
db:HITACHIid:HS07-030
Trust: 2.0
db:VUPENid:ADV-2007-3035
Trust: 1.6
db:OSVDBid:37859
Trust: 1.6
db:XFid:36374
Trust: 1.4
db:JVNDBid:JVNDB-2007-001092
Trust: 0.8
db:CNNVDid:CNNVD-200709-046
Trust: 0.6
db:SECUNIAid:26394
Trust: 0.1
db:PACKETSTORMid:58426
Trust: 0.1
db:PACKETSTORMid:59014
Trust: 0.1
sources:
            
            
            BID: 25520 // 
            
            
            
            JVNDB: JVNDB-2007-001092 // 
            
            
            
            PACKETSTORM: 58426 // 
            
            
            
            PACKETSTORM: 59014 // 
            
            
            
            CNNVD: CNNVD-200709-046 // 
            
            
            
            NVD: CVE-2007-4720

REFERENCES
url:http://secunia.com/advisories/26668
Trust: 2.4
url:http://www.securityfocus.com/bid/25520
Trust: 2.4
url:http://www.hitachi-support.com/security_e/vuls_e/hs07-030_e/index-e.html
Trust: 2.0
url:http://osvdb.org/37859
Trust: 1.6
url:http://www.frsirt.com/english/advisories/2007/3035
Trust: 1.4
url:http://xforce.iss.net/xforce/xfdb/36374
Trust: 1.4
url:http://www.vupen.com/english/advisories/2007/3035
Trust: 1.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/36374
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-4720
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-4720
Trust: 0.8
url:http://www.hds.com/products/storage-software/hitachi-device-manager.html
Trust: 0.3
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.2
url:http://secunia.com/about_secunia_advisories/
Trust: 0.2
url:https://psi.secunia.com/
Trust: 0.2
url:http://secunia.com/secunia_security_advisories/
Trust: 0.2
url:http://secunia.com/advisories/26394/
Trust: 0.2
url:http://secunia.com/product/2384/
Trust: 0.1
url:http://secunia.com/product/15200/
Trust: 0.1
url:http://secunia.com/product/15197/
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01110627
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01112038
Trust: 0.1
url:http://secunia.com/product/15202/
Trust: 0.1
url:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=574
Trust: 0.1
url:http://secunia.com/product/15208/
Trust: 0.1
url:http://secunia.com/product/15210/
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01109617
Trust: 0.1
url:http://secunia.com/product/15196/
Trust: 0.1
url:http://secunia.com/product/15209/
Trust: 0.1
url:http://secunia.com/product/15195/
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01106515
Trust: 0.1
url:http://secunia.com/product/15203/
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01115068
Trust: 0.1
url:http://secunia.com/product/3608/
Trust: 0.1
url:http://secunia.com/product/15199/
Trust: 0.1
url:http://secunia.com/product/15205/
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01114023
Trust: 0.1
url:http://secunia.com/product/15212/
Trust: 0.1
url:http://secunia.com/product/15207/
Trust: 0.1
url:http://secunia.com/product/15211/
Trust: 0.1
url:http://secunia.com/product/15204/
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01109171
Trust: 0.1
url:http://secunia.com/product/15198/
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01111851
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01109584
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01114156
Trust: 0.1
url:http://secunia.com/product/8641/
Trust: 0.1
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01110576
Trust: 0.1
url:http://secunia.com/product/2100/
Trust: 0.1
url:http://secunia.com/product/9570/
Trust: 0.1
url:http://secunia.com/advisories/26668/
Trust: 0.1
sources:
            
            
            BID: 25520 // 
            
            
            
            JVNDB: JVNDB-2007-001092 // 
            
            
            
            PACKETSTORM: 58426 // 
            
            
            
            PACKETSTORM: 59014 // 
            
            
            
            CNNVD: CNNVD-200709-046 // 
            
            
            
            NVD: CVE-2007-4720

CREDITS
The vendor disclosed this issue.
Trust: 0.9
sources:
            
            
            BID: 25520 // 
            
            
            
            CNNVD: CNNVD-200709-046

SOURCES
db:BIDid:25520
db:JVNDBid:JVNDB-2007-001092
db:PACKETSTORMid:58426
db:PACKETSTORMid:59014
db:CNNVDid:CNNVD-200709-046
db:NVDid:CVE-2007-4720

LAST UPDATE DATE
2024-11-23T22:24:07.471000+00:00

SOURCES UPDATE DATE
db:BIDid:25520date:2015-05-07T17:35:00
db:JVNDBid:JVNDB-2007-001092date:2008-05-21T00:00:00
db:CNNVDid:CNNVD-200709-046date:2007-09-10T00:00:00
db:NVDid:CVE-2007-4720date:2024-11-21T00:36:17.780

SOURCES RELEASE DATE
db:BIDid:25520date:2007-09-03T00:00:00
db:JVNDBid:JVNDB-2007-001092date:2008-05-21T00:00:00
db:PACKETSTORMid:58426date:2007-08-11T21:26:09
db:PACKETSTORMid:59014date:2007-09-05T02:20:04
db:CNNVDid:CNNVD-200709-046date:2007-09-05T00:00:00
db:NVDid:CVE-2007-4720date:2007-09-05T19:17:00