Description
The port-3443 HTTP server in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostname parameter to unspecified Perl scripts.
References
- http://zerodayinitiative.com/advisories/ZDI-09-094/
- 20091209 ZDI-09-094: Hewlett-Packard OpenView NNM Multiple Command Injection Vulnerabilities mailing-list
- 37261 vdb-entry
- SSRT090257 vendor-advisory
- SSRT090037 vendor-advisory
- hp-openviewnnm-hostname-command-execution(54651) vdb-entry
- 37300 vdb-entry