CVE-2008-0068

published 2008-04-16

CVE-2008-0068: Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to read arbitrary…

Priority P3 37 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to read arbitrary files via directory traversal sequences in the Action parameter.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
hp	openview_network_node_manager	—	—
hp	openview_network_node_manager	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://www.example.com/OvCgi/OpenView5.exe?Target=Main&Action=../../../../../../windows/win.ini↗

path /OvCgi/OpenView5.exe

command Action=../../../../../../windows/win.ini

snort

alert http1 $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER HP OpenView Network Node Manager CGI Directory Traversal"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/OvCgi/"; nocase; content:"/OpenView5.exe?"; nocase; distance:0; fast_pattern; content:"Action=../../"; nocase; distance:0; http.protocol; content:"HTTP/1."; reference:bugtraq,28745; reference:cve,CVE-2008-0068; reference:url,aluigi.altervista.org/adv/closedviewx-adv.txt; classtype:web-application-attack; sid:2008171; rev:15; metadata:created_at 2010_07_30, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)

• → Directory traversal attack targets the 'Action' parameter of OpenView5.exe via HTTP GET requests to /OvCgi/OpenView5.exe. Look for '../' sequences in the Action parameter value. ↗
• → The Snort/ET rule (sid:2008171) detects this traversal by matching HTTP GET to /OvCgi/ + /OpenView5.exe? + Action=../../, all case-insensitive, on established inbound connections.
• → Note that 'ovalarmsrv.exe' may also be named 'OpenView5.exe' — monitor both process names for anomalous CGI activity. ↗

• · Affected versions are HP OV NNM 7.01, 7.51, and 7.53; other versions may also be affected per the advisory. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22