Vulnerability Note VU#952171

Hewlett Packard OpenView and Tivoli NetView do not adequately validate SNMP trap arguments

Overview

Hewlett Packard's (HP) OpenView and Tivoli NetView are system management software packages. There is a vulnerability a component of these packages, ovactiond, that allows intruders to execute arbitrary commands as user bin. This may subsequently lead to a root compromise.

I. Description

HP OpenView and Tivoli NetView are set of tools to manage large networks. Part of OpenView and NetView is a daemon called ovactiond, which is the SNMP trap and event handler. It is possible for an intruder to execute arbitrary commands by sending a malicious message to a vulnerable version of ovactiond. These commands run with the privileges of the ovactiond process, typically bin on Unix systems, and SYSTEM on Windows NT/2000. Often it is possible to use this access to gain root access on Unix systems. An exploit is publicly available. Note that Tivoli NetView is not vulnerable via the default configuration, however, it is likely that customized configurations are vulnerable HP is vulnerable by the default configuration.

For more information, see HP Security Bulletin HPSBUX0106-154 and http://www.tivoli.com/support/.

It has been confirmed with HP that the patch referenced on Security Focus for OpenView Version 5.01 is only for Version 6.1.

II. Impact

An intruder can execute arbitrary commands with the privileges of the ovactiond process, typically bin on Unix systems, and SYSTEM on Window NT/2000 systems.

III. Solution

Apply patches from your vendor as appropriate. HP has released HP Security Bulletin HPSBUX0106-154. Tivoli has information posted on http://www.tivoli.com/support/.

Systems Affected

Vendor	Status	Date Notified
Apple	Not Vulnerable	15-Aug-2001
BSDI	Unknown	15-Aug-2001
Caldera	Unknown	15-Aug-2001
Compaq Computer Corporation	Vulnerable	15-Aug-2001
Computer Associates	Not Vulnerable	15-Aug-2001
Debian	Unknown	15-Aug-2001
Dg	Unknown	15-Aug-2001
FreeBSD	Not Vulnerable	15-Aug-2001
Fujitsu	Not Vulnerable	15-Aug-2001
Hewlett Packard	Vulnerable	24-Aug-2001
IBM	Vulnerable	15-Aug-2001
Microsoft	Vulnerable	15-Aug-2001
NEC	Unknown	15-Aug-2001
NetBSD	Unknown	15-Aug-2001
NeXT	Unknown	15-Aug-2001
OpenBSD	Unknown	15-Aug-2001
RedHat	Unknown	15-Aug-2001
SCO	Unknown	15-Aug-2001
Sequent	Unknown	15-Aug-2001
SGI	Unknown	15-Aug-2001
Siemens Nixdorf	Unknown	15-Aug-2001
Sony	Unknown	15-Aug-2001
Sun	Vulnerable	15-Aug-2001
Tivoli	Vulnerable	15-Aug-2001
Unisys	Unknown	15-Aug-2001

References

http://us-support.external.hp.com/cki/bin/doc.pl/screen=ckiDisplayDocument?docId=200000055277985
http://www.tivoli.com/support/
http://www.securityfocus.com/bid/2845

Credit

Our thanks to Milo G. van der Zee, who reported this problem to us and to Hewlett-Packard for the information contained in their advisory.

This document was written by Jason Rafail.

Other Information

Date Public:	2001-06-08
Date First Published:	2001-06-21
Date Last Updated:	2001-09-06
CERT Advisory:	CA-2001-24
CVE-ID(s):	CAN-2001-0552
NVD-ID(s):	CAN-2001-0552
US-CERT Technical Alerts:
Metric:	44.89
Document Revision:	18

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader