 |
 PDF Containing Obfuscated Name Objects and Obfuscated JavaScript Filter Name Vulnerabilities
New exploits were released for several remote code execution vulnerabilities that were discovered in the way Adobe Acrobat Reader and Foxit Reader handle specially crafted PDF files. Portable Document Format (PDF) is an open file format created by Adobe Systems. It is used for representing two-dimensional documents in a device and resolution independent fixed-layout document format. These protections will detect and block PDF files with obfuscated name objects and obfuscated JavaScript filter names.
Security Gateway R70: New protection are now available.
SBP-2009-28.
HP OpenView Network Node Manager OvWebHelp.exe Buffer Overflow VulnerabilityIndustry Reference:CVE-2009-4178.
A buffer overflow vulnerability has been reported in HP OpenView Network Node Manager (NNM). The NNM is an HP OpenView product which manages networks. It determines and displays physical and logical connectivity in networks, as well as information referring to protocols running over the network. A remote attacker could exploit this vulnerability to inject and execute arbitrary code on a target server. This protection will detect and block crafted HTTP POST requests sent to the vulnerable server.
Security Gateway R70: A new protection is now available.
CPAI-2009-332.
HP OpenView Network Node Manager ovsessionmgr.exe Buffer Overflow VulnerabilityIndustry Reference:CVE-2009-4176.
A buffer overflow vulnerability has been reported in HP OpenView Network Node Manager (NNM). The NNM is an HP OpenView product which manages networks. It determines and displays physical and logical connectivity in networks, as well as information referring to protocols running over the network. A remote attacker could exploit this vulnerability to inject and execute arbitrary code on a target server. This protection will detect and block crafted HTTP POST requests sent to the vulnerable server.
IPS-1 & IPS-1 NGX R65: A new protection is now available.
Security Gateway R70: A new protection is now available.
CPAI-2009-333.
HP OpenView Network Node Manager snmpviewer.exe Host Header Buffer Overflow VulnerabilityIndustry Reference:CVE-2009-4180.
A buffer overflow vulnerability exists in the HP OpenView Network Node Manager (NNM) CGI program snmpviewer.exe. The vulnerability is due to a boundary error when processing the Host header from HTTP requests. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to a target server, potentially causing arbitrary code injection and execution. Security Gateway R70 and IPS-1 will detect and block HTTP requests with host headers that are longer than 128 bytes. No update is required to address this vulnerability.
IPS-1 & IPS-1 NGX R65: Preemptive protection is provided by this product.
Security Gateway R70: Preemptive protection is provided by this product.
CPAI-2009-310.
HP OpenView Network Node Manager webappmon.exe CGI Host Header Buffer Overflow VulnerabilityIndustry Reference:CVE-2009-4177.
A buffer overflow vulnerability exists in the HP OpenView Network Node Manager (NNM) CGI program webappmon.exe. The vulnerability is due to a boundary error when processing the Host header from HTTP requests. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to a target server, potentially causing arbitrary code injection and execution. Security Gateway R70 and IPS-1 will detect and block HTTP requests with host headers that are longer than 128 bytes. No update is required to address this vulnerability.
IPS-1 & IPS-1 NGX R65: Preemptive protection is provided by this product.
Security Gateway R70: Preemptive protection is provided by this product.
CPAI-2009-311.
HP Operations Manager Server Unauthorized File Upload VulnerabilityIndustry Reference:CVE-2009-3843.
An unauthorized file upload vulnerability exists in HP Operations Manager, a consolidated event and performance management console that correlates infrastructure, network and end-user experience events across an IT infrastructure.The vulnerability is due to insufficient access control within the Apache Tomcat Manager component. A remote attacker can trigger the vulnerability by sending a crafted HTTP request to /manager/html/upload and once authenticated, upload a malicious web application to a vulnerable system. This protection will detect and block attempts to access the HP operations manager file upload area using default credentials.
IPS-1 & IPS-1 NGX R65: A new protection is now available.
Security Gateway R70: A new protection is now available.
CPAI-2009-312.
HP OpenView Network Node Manager ovlogin.exe Buffer Overflow VulnerabilityIndustry Reference:CVE-2009-3846.
A buffer overflow vulnerability exists in HP OpenView Network Node Manager (NNM). The vulnerability is due to a boundary error in ovlogin.exe, the login process of a CGI application shipped with OpenView NNM. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to a target server, potentially causing arbitrary code injection and execution on the target system. This protection will detect and block HP OpenView CGI binary ovlogin.exe requests with a long username or password parameter.
IPS-1 & IPS-1 NGX R65: A new protection is now available.
CPAI-2009-313.
HP OpenView Network Node Manager ovalarm.exe Accept-Language Buffer Overflow VulnerabilityIndustry Reference:CVE-2009-4179.
A stack buffer overflow exists in HP OpenView Network Node Manager (NNM) CGI program ovalarm.exe. The vulnerability is due to a boundary error when processing Accept-Language HTTP header and the OvAcceptLang cookie value in a crafted HTTP request. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to a target server. This protection will detect and block HTTP requests with Accept-Language parameters whose length exceeds a threshold and requests for the HP OpenView CGI binary Toolbar.exe with long cookie parameters.
IPS-1 & IPS-1 NGX R65: A new protection is now available.
Security Gateway R70: A new protection is now available.
CPAI-2009-314.
EMC RepliStor rep_srv and ctrlservice Denial of Service VulnerabilityIndustry Reference:CVE-2009-3744.
A denial of service vulnerability exists in EMC RepliStor. EMC RepliStor is a data recovery and protection system designed for Microsoft Windows. The vulnerability is due to an input validation error while parsing a specially crafted packet sent to 'rep_srv.exe' and 'ctrlservice.exe' services. Successful exploitation would cause a denial of service condition. This protection will detect and block certain malicious packets being sent to the EMC RepliStor process.
IPS-1 & IPS-1 NGX R65: A new protection is now available.
CPAI-2009-309.
|
January 3, 2010
 |
You have received this notification because you have subscribed to the SmartDefense mailing list. If you would prefer to no longer receive security alerts and defense notifications please click to Unsubscribe
As always, please feel free to contact us directly if you have any comments or questions.
Read Check Point's Privacy Policy
©2003.2009 Check Point Software Technologies Ltd. (Nasdaq: CHKP) All rights reserved.
800 Bridge Parkway, Redwood City, CA USA 94065 |
|