Description
HP Network Node Manager (NNM) Remote Console 7.50, 7.51, and 7.53 assigns Everyone Full Control permission for the %PROGRAMFILES%\HP OpenView directory tree, which allows local users to gain privileges via a Trojan horse executable file or ActiveX component, or a modified bin\ovtrcsvc.exe for the HP Open View Shared Trace Service.
References
- HPSBMA02448 vendor-advisory
- openview-nnm-directory-privilege-escalation(32362) vdb-entry
- 22475 vdb-entry
- 1017609 vdb-entry
- 20070208 SecurityVulns.com: HP Network Node Manager remote console weak files permissions mailing-list
- ADV-2007-0533 vdb-entry
- 33130 vdb-entry
- 24066 third-party-advisory
- http://securityvulns.com/news/HP/NNM/RC/WP.html