HPOpenView Performance Agent DynaZip Buffer Overflow Vulnerability
RISK: Medium Risk
A vulnerability has been identified in HP OpenView Performance Agent and HP Performance Agent, which could be exploited by remote attackers to compromise a vulnerable system.Buffer overflow errors in the "dzip32.dll" and "dzips32.dll" libraries when repairing, adding, updating, or freshening files in a ZIP archive containing a file with an overly long filename, which could be exploited by attackers to compromise a vulnerable system via a specially crafted ZIP archive.
Impact
- Remote Code Execution
System / Technologies affected
- HP OpenView Performance Agent version C.04.60 (Windows)
- HP Performance Agent version C.04.70 (Windows)
- HP Performance Agent version C.04.72 (Windows)
Solutions
Note: There is no patch available for this vulnerability currently.
Workaround:
Contact HP Services support and request the Performance Agent Hotfix: "Migrate away from the 3.0.0.15 version of DynaZip library".
Vulnerability Identifier
Source
Related Link
Share with