HP OpenView Network Node Manager Directory Traversal, Denial of Service, NULL Pointer and Process Termination Vulnerabilities
The CGIs available in NNM use some instructions which filters malicious chars in the parameters passed by the clients, for example to avoid directory traversal attacks, XSS and so on. The path delimiter filtered by these CGIs is the backslash char, so using the slash will allow an attacker to download the files from the disk on which is installed NNM. The ovalarmsrv service listening on port 2954 can be easily freezed with CPU at 100% and without the possibility of handling further requests on both its poerts (2954 and 2955) by sending a malformed packet. The packet must contain a specific value in the “length” field of the header which is not checked by the service. The same service can be crashed by sending a packet with a specific value in the “length” field of the header which causes a NULL pointer dereferencing. The ovtopmd process can be terminated by sending a packet with a specific value in the “length” field of the header which causes a memory corruption.
