bugtraq - TSRT-06-13: HP OpenView Client Configuration Manager Device Code Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <OF498ACC4B.68CEFDC2-ON88257220.0061B1E2-88257220.0061DDC3@3com.com>
Date: Wed, 8 Nov 2006 09:48:58 -0800
From: TSRT@...m.com
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: TSRT-06-13: HP OpenView Client Configuration Manager Device Code Execution
 Vulnerability

TSRT-06-13: HP OpenView Client Configuration Manager Device Code
            Execution Vulnerability

http://www.tippingpoint.com/security/advisories/TSRT-06-12.html
November  8, 2006

-- CVE ID:
CVE-2006-5782

-- Affected Vendor:
Hewlett-Packard

-- Affected Products:
OpenView Client Configuration Manager 1.0

-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable device installations of HP OpenView Client Configuraton
Manager (CCM). Authentication is not required to exploit this
vulnerability. The CCM server is not affected.

The specific flaw exists within the Radia Notify Daemon, radexecd.exe,
which binds to TCP port 3465 on default CCM device installs. The
vulnerable daemon expects to receive data in the following format:

    port\x00username\x00password\x00command

Where 'port' specifies a connect back port on the connecting client.
Due to a design flaw a correct username and password is not required in
order to execute arbitrary commands within the radexecd.exe install
directory. This exposes at least two pre-authentication issues. The
first, allows attackers to reboot affected devices by launching
radbootw.exe, which reboots the system without any further prompts. The
second, allows attackers to generate an arbitrary file by launching
radcrecv.exe. radcrecv will listen to an arbitrary port as specified on
the command line and receive files via multicast download. The filename
and contents can be specified by the attacker and is saved to the same
directory as radexecd.exe. Once a malicious file has been generated, it
can then be launched as before.

-- Vendor Response:
Hewlett-Packard has issued an update to correct this vulnerability. More
details can be found at:

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00795552

-- Disclosure Timeline:
2006.10.10 - Vulnerability reported to vendor
2006.11.08 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by Pedram Amini, TippingPoint Security
Research Team.