tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a (1) large or (2) invalid opcode field, related to a function pointer table.

The version of HP Intelligent Management Center running on the remote host contains a number of vulnerabilities that can be exploited remotely without authentication, including code execution and arbitrary file creation.

A TFTP server belonging to HP Intelligent Management Center is running on the remote host.  This is a collection point for any HP Intelligent Management Center clients on the network. 

The installed version of this server contains a number of vulnerabilities, including code execution and arbitrary file creation. 

It is also likely that the HP Intelligent Management Center install itself is affected by other vulnerabilities, although this plugin has not checked for those issues.

According to its version number, the HP Intelligent Management Center install on the remote host is potentially affected by multiple vulnerabilities :

  - A stack-based buffer overflow vulnerability exists in     the 'img.exe' component. (CVE-2011-1848)

  - A flaw exists in the 'tftpserver.exe' component which     could allow arbitrary file creation when handling WRQ     opcode types. (CVE-2011-1849)

  - A stack-based buffer overflow vulnerability exists in     the 'dbman.exe' component. (CVE-2011-1850)

  - A stack-based buffer overflow vulnerability exists in     the 'tftpserver.exe' component. (CVE-2011-1851)

  - A stack-based buffer overflow vulnerability exists in     the 'tftpserver.exe' component. (CVE-2011-1852)

  - A buffer overflow vulnerability exists in the     'tftpserver.exe' component when handling a large or     invalid opcode word of a packet. (CVE-2011-1853)

  - A use-after-free vulnerability exists in the     'imcsyslogdm.exe' component. (CVE-2011-1854)

Versions of HP Intelligent Management Center earlier than 5.0 E0101-L02 are potentially affected by multiple vulnerabilities : 

  - A stack-based buffer overflow vulnerability exists in the 'img.exe' component. (CVE-2011-1848)

  - An unspecified vulnerability in the 'tftpserver.exe' component exists which could allow an attacker to create arbitrary files on the server. (CVE-2011-1849)

  - A stack-based buffer overflow vulnerability exists in the 'dbman.exe' component. (CVE-2011-1850)

  - Multiple buffer overflow vulnerabilities exist in the 'tftpserver.exe' component. (CVE-2011-1851, CVE-2011-1852, CVE-2011-1853)

  - A use-after-free vulnerability exists in the 'imcsyslogdm.exe' component. (CVE-2011-1854)

ID	Name	Product	Family	Severity
54999	HP Intelligent Management Center Multiple Vulnerabilities	Nessus	Gain a shell remotely	critical
54986	HP Intelligent Management Center TFTP Multiple Vulnerabilities	Nessus	Gain a shell remotely	critical
54628	HP Intelligent Management Center < 5.0 E0101-L02 Multiple Vulnerabilities	Nessus	Windows	critical
5927	HP Intelligent Management Center < 5.0 E0101-L02 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2011-1853

critical

Tenable Plugins

critical

critical

critical

critical