HP Plugs Critical Security Holes in OpenView Network Management Technology

Core Security Technologies has issued an advisory for multiple vulnerabilities affecting HP’s popular OpenView systems and network management software.

An engineer from CoreLabs, the company's research arm, uncovered three vulnerabilities in HP OpenView NNM (Network Node Manager) that can be exploited remotely via buffer overflows to compromise mission-critical servers. Though two of the vulnerabilities are brand new, the third is a stack-based bug found on CGI parameter OvOSLocale that HP had previously issued a patch for but was still exploitable. 

According to CoreLabs, attackers can leverage the vulnerabilities by sending specially crafted HTTP requests to HP OpenView’s Web server component, allowing them to execute arbitrary code on the target system. HP has issued fixes for all three vulnerabilities in response to CoreLabs' findings.

“While remote network management technologies offer substantial value in terms of allowing organizations to maintain constant vigilance and control over their networks, the flipside is that attackers can potentially use available vulnerabilities in these systems to wreak havoc on internal infrastructure,” said Ivan Arce, CTO of Core Security Technologies, in a statement. “It is vitally important for remote systems management solution providers to minimize these easily exploitable security flaws that can allow for remote system compromise.”

HP OpenView NNM is a widely used remote network management technology that allows network managers to monitor their physical networks, virtual network services and the relationships between those assets.

While examining a set of previously disclosed vulnerabilities affecting the product, a researcher at CoreLabs uncovered that OpenView NMM versions 7.51 and 7.53 harbored two previously unknown flaws, and that a patch for the third security issued could be circumvented.

The flaws also affect Version 7.01. The HP support document addressing these issues can be found here.