标题: HP OpenView Network Node Manager缓冲溢出 [打印本页]

---

作者: pioneer     时间: 2009-5-15 10:45    标题: HP OpenView Network Node Manager缓冲溢出

来源

secunia.com

软件名

HP OpenView Network Node Manager (NNM) 7.x

描述

1)一个越界访问错误可通过包含发送超长"OvAcceptLang"参数的HTTP请求到Toolbar.exe来导致堆缓冲溢出
2)一个越界访问错误可通过包含发送超长"OvOSLocale"参数的HTTP请求到Toolbar.exe来导致堆栈缓冲溢出
3)一个越界访问错误在处理发送到"Toolbar.exe"CGI应用程序的http请求来导致通过超长的"Accept-Language"头文件来导致堆缓冲溢出
溢出成功后可执行任意代码
HP-UX, Linux, Solaris,和Windows下，据报告该漏洞在V7.01, 7.51,和7.53中已经受到影响

解决方案

安装补丁或应用hotfix
http://support.openview.hp.com/selfsolve/patches
ftp://ss090008:ss090008@hprc.external.hp.com/

-- OV NNM v7.53 --

HP-UX (IA):
Install PHSS_38783 or subsequent and apply
SSRT090008.QCCR1B26779.hotfix.tar.

HP-UX (PA):
Install PHSS_38782 or subsequent and apply
SSRT090008.QCCR1B26779.hotfix.tar.

Linux RedHatAS2.1:
Install LXOV_00089 or subsequent and apply
SSRT090008.QCCR1B26779.hotfix.tar.

Linux RedHat4AS-x86_64:
Install LXOV_00090 or subsequent and apply
SSRT090008.QCCR1B26779.hotfix.tar.

Solaris:
Install PSOV_03517 or subsequent and apply
SSRT090008.QCCR1B26779.hotfix.tar.

Windows:
Install NNM_01195 or subsequent and apply
SSRT090008.QCCR1B26779.hotfix.tar.

-- OV NNM v7.51 --

Upgrade to NNM v7.53 and install the patches listed above.
Patch bundles for upgrading from NNM v7.51 to NNM v5.53 are available
here:
ftp://nnm_753:update@hprc.external.hp.com/

-- OV NNM v7.01 --

HP-UX (PA):
Install PHSS_38761 or subsequent and apply
SSRT090008.QCCR1B26779.hotfix.tar.

Solaris:
Install PSOV_03516 or subsequent and apply
SSRT090008.QCCR1B26779.hotfix.tar.

Windows:
Install NNM_01194 or subsequent and apply
SSRT090008.QCCR1B26779.hotfix.tar.

---

欢迎光临 微点交流论坛 (http://bbs.micropoint.com.cn/)

bbs.micropoint.com.cn