Description
Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.
References
- ADV-2009-0819 vdb-entry
- hp-ovnnm-ovacceptlang-acceptlanguage-bo(49363) vdb-entry
- 34134 vdb-entry
- http://www.coresecurity.com/content/openview-buffer-overflows
- 20090323 CORE-2009-0122: HP OpenView Buffer Overflows mailing-list
- 34135 vdb-entry
- 34444 third-party-advisory
- SSRT090008 vendor-advisory
- 1021883 vdb-entry