CWE
119
Advisory Published
Updated

CVE-2009-0921: Buffer Overflow

First published: Wed Mar 25 2009(Updated: )

Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
HP Network Node Manager i=7.0.1
HP Network Node Manager i=7.5.1
HP Network Node Manager i=7.5.3

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the severity of CVE-2009-0921?

    CVE-2009-0921 is considered critical due to its ability to allow remote attackers to execute arbitrary code.

  • Which versions of HP OpenView Network Node Manager are affected by CVE-2009-0921?

    CVE-2009-0921 affects HP OpenView Network Node Manager versions 7.0.1, 7.5.1, and 7.5.3.

  • How do I fix CVE-2009-0921?

    To mitigate CVE-2009-0921, upgrade to a version of HP OpenView Network Node Manager that is not vulnerable.

  • What causes the vulnerability in CVE-2009-0921?

    CVE-2009-0921 is caused by multiple heap-based buffer overflows triggered by long HTTP headers and cookies.

  • Can CVE-2009-0921 be exploited remotely?

    Yes, CVE-2009-0921 can be exploited remotely by sending crafted requests to the affected software.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203