CVE-2006-5782 - radexecd.exe in HP OpenView Client Configuraton Manager (CCM) does not require authentication before

CVE-2006-5782

Summary

radexecd.exe in HP OpenView Client Configuraton Manager (CCM) does not require authentication before executing commands in the installation directory, which allows remote attackers to cause a denial of service (reboot) by calling radbootw.exe or create arbitrary files by calling radcrecv.

References

Vulnerable Configurations

cpe:2.3:a:hp:openview_client_configuraton_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:hp:openview_client_configuraton_manager:*:*:*:*:*:*:*:*

CVSS

Base:	7.8 (as of 17-10-2018 - 21:45)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:C

refmap via4

bugtraq	20061108 TSRT-06-13: HP OpenView Client Configuration Manager Device Code Execution Vulnerability
hp	HPSBMA02167 SSRT061262
sectrack	1017197
secunia	22780
sreason	1842
vupen	ADV-2006-4410
xf	hp-openview-radianotify-dos(30138)

Last major update

17-10-2018 - 21:45

Published

09-11-2006 - 00:07

Last modified

17-10-2018 - 21:45