CVE-2009-0921

2009-03-2501:30:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2009-0921

buffer overflows

hp openview network node manager

ov nnm

security vulnerability

remote code execution

nvd

7.6 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.056 Low

EPSS

Percentile

93.2%

JSON

Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.

CPENameOperatorVersion
hp:network_node_managerhp network node managereq7.0.1
hp:network_node_managerhp network node managereq7.5.1
hp:network_node_managerhp network node managereq7.5.3

CPE	Name	Operator	Version
hp:network_node_manager	hp network node manager	eq	7.0.1
hp:network_node_manager	hp network node manager	eq	7.5.1
hp:network_node_manager	hp network node manager	eq	7.5.3