TITLE:
OpenView Event Correlation Services Unspecified Privileged Access
Vulnerability

SECUNIA ADVISORY ID:
SA17039

VERIFY ADVISORY:
http://secunia.com/advisories/17039/

CRITICAL:
Moderately critical

IMPACT:
System access

WHERE:
>From local network

SOFTWARE:
HP OpenView Event Correlation Services 3.x
http://secunia.com/product/5034/

DESCRIPTION:
A vulnerability has been reported in OpenView Event Correlation
Services, which can be exploited by malicious people to gain access
with escalated privileges.

The vulnerability is caused due to an unspecified error and affects
versions 3.10, 3.20, 3.30, 3.31, 3.32, and 3.33 running on HP-UX
B.11.00, B.11.11, and B.11.23, Solaris, Windows NT, Windows 2000,
Windows XP, and Linux.

No more information is currently available.

SOLUTION:
Apply patches.
http://support.openview.hp.com/patches/patch_index.jsp

NOTE: The "ecscmg.ovpl" file should be restored to the "cgi-bin"
directory before applying the patches if it has been moved to another
directory as a prior workaround.

OV ECS 3.32/3.33 for HP-UX B.11.00/B.11.11/B.11.23:
Install PHSS_33538 or later.

OV ECS 3.32/3.33 for HP-UX B.11.23 (IA):
Install PHSS_33539 or later.

OV ECS 3.30/3.31 for HP-UX B.11.00/B.11.11/B.11.23:
Install PHSS_33659 or later.

OV ECS 3.20 for HP-UX B.11.00/B.11.11:
Install PHSS_33797 or later.

OV ECS 3.10 for HP-UX B.11.00/B.11.11:
Install PHSS_33845 or later.

OV ECS 3.33 for SunOS 5.8/5.9/5.10:
Install PSOV_03411 or later.

OV ECS 3.31 for SunOS 5.8/5.9:
Install PSOV_03419 or later.

OV ECS 3.20 for SunOS 5.8/5.9:
Install PSOV_03427 or later.

OV ECS 3.10 for SunOS 5.8/5.9:
Install PSOV_03431 or later.

OV ECS 3.33 for Windows NT/2000/XP:
Install ECS_00039 or later.

OV ECS 3.31 for Windows NT/2000/XP:
Install ECS_00040 or later.

OV ECS 3.20 for Windows NT/2000:
Install ECS_00041 or later.

OV ECS 3.10 for Windows NT/2000:
Install ECS_00042 or later.

OV ECS 3.33 for Linux RedHatAS2.1:
Install ECSLX_00006 or later.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits NGSSoftware.

ORIGINAL ADVISORY:
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBMA01225

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------