Quantum Secular Labs / Blog / Advisories
CVE-2001-0134: Compaq Management Agents: Command injection
CVE-2001-0134 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Compaq Management Agents, along with 14 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.
Vulnerability description
Buffer overflow in cpqlogin.htm in web-enabled agents for various Compaq management software products such as Insight Manager and Management Agents allows remote attackers to execute arbitrary commands via a long user name.
Severity breakdown
CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C
- Access vector: Network. Exploitable remotely over the network.
- Access complexity: Low. No special conditions are required.
- Authentication: None. No authentication is needed.
- Confidentiality impact: Complete. Total information disclosure.
- Integrity impact: Complete. Total loss of integrity.
- Availability impact: Complete. Total shutdown of the component.
Affected products
- Compaq Management Agents: 4.30j; 4.35j; 4.36e; 4.36j
- Compaq Armada Insight Manager: 4.20; 4.20j
- Compaq Enterprise Volume Manager Command Scripter: 1.0; 1.1
- Compaq Foundation Agents: 1.0; 2.1; 4.0; 4.90
- Compaq Insight Management Agent: 4.37e
- Compaq Insight Management Desktop Web Agent: 3.7
- Compaq Insight Manager Lc: 1.3c; 1.50a
- Compaq Insight Manager Xe: 1.0; 1.21
- Compaq Intelligent Cluster Administrator: 1.0; 2.1
- Compaq Open San Manager: 1.0
- Compaq Sanworks Resource Monitor: 1.0
- Compaq Storage Allocation Reporter: 1.0
- Compaq Survey Utility: 2.17; 2.18; 2.33
- Compaq System Healthcheck: 3.0
- Digital Unix: 4.0f; 4.0g; 5.0