Vulnerability Note VU#952171
Hewlett Packard OpenView and Tivoli NetView do not adequately validate SNMP trap arguments
Hewlett Packard's (HP) OpenView and Tivoli NetView are system management software packages. There is a vulnerability a component of these packages, ovactiond, that allows intruders to execute arbitrary commands as user bin. This may subsequently lead to a root compromise.
HP OpenView and Tivoli NetView are set of tools to manage large networks. Part of OpenView and NetView is a daemon called ovactiond, which is the SNMP trap and event handler. It is possible for an intruder to execute arbitrary commands by sending a malicious message to a vulnerable version of ovactiond. These commands run with the privileges of the ovactiond process, typically bin on Unix systems, and SYSTEM on Windows NT/2000. Often it is possible to use this access to gain root access on Unix systems. An exploit is publicly available. Note that Tivoli NetView is not vulnerable via the default configuration, however, it is likely that customized configurations are vulnerable HP is vulnerable by the default configuration.
For more information, see HP Security Bulletin HPSBUX0106-154 and http://www.tivoli.com/support/.
An intruder can execute arbitrary commands with the privileges of the ovactiond process, typically bin on Unix systems, and SYSTEM on Window NT/2000 systems.
Apply patches from your vendor as appropriate. HP has released HP Security Bulletin HPSBUX0106-154. Tivoli has information posted on http://www.tivoli.com/support/.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Compaq Computer Corporation||Affected||21 Jun 2001||15 Aug 2001|
|Hewlett Packard||Affected||15 Jun 2001||24 Aug 2001|
|IBM||Affected||21 Jun 2001||15 Aug 2001|
|Microsoft||Affected||15 Jun 2001||15 Aug 2001|
|Sun||Affected||15 Jun 2001||15 Aug 2001|
|Tivoli||Affected||27 Jun 2001||15 Aug 2001|
|Apple||Not Affected||21 Jun 2001||15 Aug 2001|
|Computer Associates||Not Affected||07 Aug 2001||15 Aug 2001|
|FreeBSD||Not Affected||21 Jun 2001||15 Aug 2001|
|Fujitsu||Not Affected||21 Jun 2001||15 Aug 2001|
|BSDI||Unknown||21 Jun 2001||15 Aug 2001|
|Caldera||Unknown||21 Jun 2001||15 Aug 2001|
|Debian||Unknown||21 Jun 2001||15 Aug 2001|
|Dg||Unknown||21 Jun 2001||15 Aug 2001|
|NEC||Unknown||21 Jun 2001||15 Aug 2001|
CVSS Metrics (Learn More)
Our thanks to Milo G. van der Zee, who reported this problem to us and to Hewlett-Packard for the information contained in their advisory.
This document was written by Jason Rafail.
- CVE IDs: CAN-2001-0552
- CERT Advisory: CA-2001-24
- Date Public: 08 Jun 2001
- Date First Published: 21 Jun 2001
- Date Last Updated: 06 Sep 2001
- Severity Metric: 44.89
- Document Revision: 18
If you have feedback, comments, or additional information about this vulnerability, please send us email.