.:[ packet storm ]:.
                         
beyond paranoid
beyond paranoid

 ///  File Name:ZDI-09-085.txt
Description:
Zero Day Initiative Advisory 09-085 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Operations Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists due to a hidden account present within the Tomcat users XML file. Using this account a malicious user can access the org.apache.catalina.manager.HTMLManagerServlet class. This is defined within the catalina-manager.jar file installed with the product. This servlet allows a remote user to upload a file via a POST request to /manager/html/upload. If an attacker uploads malicious content it can then be accessed and executed on the server which leads to arbitrary code execution under the context of the SYSTEM user.
Author:TippingPoint
Homepage:http://www.zerodayinitiative.com/
File Size:3213
Related CVE(s):CVE-2009-3843
Last Modified:Nov 20 18:48:15 2009
MD5 Checksum:457fd4230dd9490ce104d8153f689e68

 .:. Back
 

 ///  Last 10 Files
  1. :· joomlaseek-sql.txt
  2. :· CVE-2010-0188.py.txt
  3. :· joomlaraces-sql.txt
  4. :· joomlasbsfile-lfi.txt
  5. :· joomladgreinar-xss.txt
  6. :· onlineshop-lfi.txt
  7. :· azeno-sql.txt
  8. :· joomlajulia-lfi.txt
  9. :· vupensafari-overflow.txt
  10. :· stats-poc.py.txt
[ Last 20 | Last 50 | Last 100 ]

 ///  Last 10 Advisories
  1. :· vupensafari-overflow.txt
  2. :· dsa-2014-1.txt
  3. :· USN-911-1.txt
  4. :· dsa-2012-1.txt
  5. :· 03.11.10-1.txt
  6. :· dsa-2013-1.txt
  7. :· MDVSA-2010-061.txt
  8. :· ZDI-10-027.txt
  9. :· ZDI-10-028.txt
  10. :· USN-909-1.txt
[ Last 20 | Last 50 | Last 100 ]

 ///  Last 10 Exploits
  1. :· joomlaseek-sql.txt
  2. :· CVE-2010-0188.py.txt
  3. :· joomlaraces-sql.txt
  4. :· joomlasbsfile-lfi.txt
  5. :· joomladgreinar-xss.txt
  6. :· onlineshop-lfi.txt
  7. :· azeno-sql.txt
  8. :· joomlajulia-lfi.txt
  9. :· stats-poc.py.txt
  10. :· bsdftpd-dos.txt
[ Last 20 | Last 50 | Last 100 ]

 ///  Last 10 Tools
  1. :· nuxkeylogger0.0.1.c
  2. :· samhain-2.6.3.tar.gz
  3. :· cookiemonster_v1.6.zip
  4. :· gnupg-2.0.15.tar.bz2
  5. :· fwbuilder-4.0.0.tar.gz
  6. :· tor.uclibc.i686.20100309.iso
  7. :· reverberation.c
  8. :· Ravage.zip
  9. :· reglookup-0.12.0.tar.gz
  10. :· khc_0.2.tar.gz
[ Last 20 | Last 50 | Last 100 ]

 ///  Last 10 Misc
  1. :· tcpdump.pdf
  2. :· physical-terminations.pdf
  3. :· common-ports.pdf
  4. :· Wireshark_Display_Filters.pdf
  5. :· VLANs.pdf
  6. :· Spanning_Tree.pdf
  7. :· QoS.pdf
  8. :· PPP.pdf
  9. :· OSPF.pdf
  10. :· NAT.pdf
[ Last 20 | Last 50 | Last 100 ]


 .:. TopPrivacy Statement | Copyright Notice