Multiple vulnerabilities have been identified in HP OpenView Network Node Manager (OV NNM), which could be exploited by remote attackers to gain knowledge of sensitive information or compromise a vulnerable system.
The first issue is caused by a buffer overflow error in the "ovlaunch" CGI application when processing the "Host" parameter, which could allow attackers to overwrite certain pointers and execute arbitrary code via a specially crafted request.
The second vulnerability is caused by input validation errors in the "webappmon.exe" and "OpenView5.exe" applications when processing user-supplied arguments while starting external programs, which could allow attackers to inject and execute arbitrary commands.
The third issue is caused due to the "nnmRptConfig.exe" CGI application disclosing the location of log directories when responding to specifically crafted requests.
The fourth weakness is caused due to the "ovlaunch.exe" CGI application returning various configuration details when responding to requests containing a malformed parameter.
