CVE-2009-0921 Memory corruption in n/a

Critical 10.0 Published 25 Mar 2009 Updated 7 Aug 2024

Remote attackers can execute arbitrary code via heap-based buffer overflows in HP OpenView Network Node Manager web interface components.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2009-0921?

CVE-2009-0921 is a critical memory corruption vulnerability in n/a, published on 25 Mar 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.

Weakness: CWE-119

Which versions are affected by CVE-2009-0921?

It affects 1 product.

Products include Hp Network Node Manager.

How do I fix CVE-2009-0921?

No fix has been published for CVE-2009-0921 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2009-0921 being exploited?

There is no known exploitation of CVE-2009-0921 in the wild and no public exploit code.

Sources

Also known as GHSA-6c5j-6f9w-rg72.