HP OpenView CGI displayWidth Stack Overflow

This strike identifies a vulnerability in HP Openview's Network Node Manager. Specifically the CGI graph application jovgraph.exe provides an interface to NNM by using GET requests to pass parameters. The vulnerability exists within ovutil.dll, and fails to correctly validate the displayWidth parameter passed by jovgraph.exe. A function stringToSeconds converts this displayWidth to seconds and is allocated a buffer size of 0x80. Any user supplied string beginning with a number and greater than 128 bytes will overflow this buffer.