CVE-2009-0921

HP Network Node Manager 7.01, 7.51, 7.53 - Remote Code Execution via Long OvAcceptLang Cookie or Accept-Language Header

Title source: llm
STIX 2.1

Description

Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.

References (9)

Core 9
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0819
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/49363
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34134
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/502054/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34135
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34444
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=123791084113871&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021883

Scores

EPSS 0.3029
EPSS Percentile 96.8%

Details

CWE
CWE-119
Status published
Products (3)
hp/network_node_manager 7.0.1
hp/network_node_manager 7.5.1
hp/network_node_manager 7.5.3
Published Mar 25, 2009
Tracked Since Feb 18, 2026