HP OpenView connectedNodes.ovpl Command Execution
Severity: HIGH
CVE Identifier: CVE-2005-2773
Advisory Date: JUL 21, 2015
DESCRIPTION
HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.
TREND MICRO PROTECTION INFORMATION
Apply associated Trend Micro DPI Rules.
SOLUTION
Trend Micro Deep Security DPI Rule Number: 1000143
Trend Micro Deep Security DPI Rule Name: 1000143 - HP OpenView connectedNodes.ovpl Command Execution
AFFECTED SOFTWARE AND VERSION
- HP OpenView Network Node Manager 6.10
- HP OpenView Network Node Manager 6.2
- HP OpenView Network Node Manager 6.2 NT 4.X/Windows 2000
- HP OpenView Network Node Manager 6.2 Solaris
- HP OpenView Network Node Manager 6.31
- HP OpenView Network Node Manager 6.31 NT 4.X/Windows 2000
- HP OpenView Network Node Manager 6.4
- HP OpenView Network Node Manager 6.4 NT 4.X/Windows 2000
- HP OpenView Network Node Manager 6.4 Solaris
- HP OpenView Network Node Manager 6.41
- HP OpenView Network Node Manager 6.41 Solaris
- HP OpenView Network Node Manager 7.0 1 Windows 2000/XP
- HP OpenView Network Node Manager 7.50
- HP OpenView Network Node Manager 7.50 Solaris
- HP OpenView Network Node Manager 7.50 Windows 2000/XP