Showing 1 - 2 of 2

CVE-2012-0127

Status Candidate

Overview

Unspecified vulnerability in HP Performance Manager 9.00 allows remote attackers to execute arbitrary code via unknown vectors.

Zero Day Initiative Advisory 12-100: Posted Jun 22, 2012; Authored by Tipping Point | Site zerodayinitiative.com; Zero Day Initiative Advisory 12-100 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP OpenView Performance Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PMParamHandler component of Performance Manager, which is served via an Apache Tomcat instance that listens on TCP port 8081. The process receives a filename from a remote user and performs insufficient validation of the provided file path. Additionally, the user can specify an arbitrary extension due to premature truncation resulting from an embedded null byte. Remote unauthenticated attackers can exploit this vulnerability by sending malformed message packets to the target, which could lead to a directory traversing arbitrary file write and ultimately remote code execution under the context of the SYSTEM user.; tags | advisory, remote, arbitrary, tcp, code execution; advisories | CVE-2012-0127; SHA-256 | 62fba378efa118194bf75380e1caf3bdbb3a81ca43f314376ca1627030337be8; Download | Favorite | View

HP Security Bulletin HPSBMU02756 SSRT100596: Posted Mar 29, 2012; Authored by HP | Site hp.com; HP Security Bulletin HPSBMU02756 SSRT100596 - A potential security vulnerability has been identified with HP Performance Manager running on HP-UX, Linux, Solaris, and Windows. The vulnerability could be exploited remotely to execute arbitrary code and to create a Denial of Service (DoS). Revision 1 of this advisory.; tags | advisory, denial of service, arbitrary; systems | linux, windows, solaris, hpux; advisories | CVE-2012-0127; SHA-256 | efc98ae21b7578cdda64deb5dc05500c54b69e6f2036619387554bc0530e3ad6; Download | Favorite | View

Page 1 of 1 Back 1 Next