Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2007-4349: The Shared Trace Service (aka OVTrace) in HP Performance Agent C.04.70 (aka 4.70), HP OpenView Performance Age

37
Routine
MEDIUM 4.3DOWNGRADEDOWNGRADEDOWNGRADE

CVE-2007-4349 is a medium-severity flaw (CVSS 4.3) affecting openview performance agent, openview reporter, performance agent. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Shared Trace Service (aka OVTrace) in HP Performance Agent C.04.70 (aka 4.70), HP OpenView Performance Agent C.04.60 and C.04.61, HP Reporter 3.8, and HP OpenView Reporter 3.7 (aka Report 3.70) allows remote attackers to cause a denial of service via an unspecified series of RPC requests (aka Trace Event Messages) that triggers an out-of-bounds memory access, related to an erroneous object reference.

Why this priority

  • No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score4.3 (Medium)
EPSS exploit chance3.1% (top 12%)
CISA exploited listNo
Published2008-10-23
Last modified2026-06-16
Publisher (CNA): Flexera Software LLC · Vendor: hp

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

hp openview performance agent DOWNGRADE
Affected: c.04.60 · c.04.61
Fixed in: no fixed release known
Safe to downgrade to: a release before c.04.60
1. Check installed version
apt-cache policy openview-performance-agent || rpm -q openview-performance-agent || openview-performance-agent --version
2. No fixed release: DOWNGRADE to a release before c.04.60 (Debian / Ubuntu)
apt-cache madison openview-performance-agent sudo apt install openview-performance-agent=<VERSION_BEFORE_c.04.60> sudo apt-mark hold openview-performance-agent
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list openview-performance-agent sudo dnf downgrade openview-performance-agent-<VERSION_BEFORE_c.04.60> sudo dnf versionlock add openview-performance-agent
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
hp openview reporter DOWNGRADE
Affected: 3.70
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.70
1. Check installed version
apt-cache policy openview-reporter || rpm -q openview-reporter || openview-reporter --version
2. No fixed release: DOWNGRADE to a release before 3.70 (Debian / Ubuntu)
apt-cache madison openview-reporter sudo apt install openview-reporter=<VERSION_BEFORE_3.70> sudo apt-mark hold openview-reporter
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list openview-reporter sudo dnf downgrade openview-reporter-<VERSION_BEFORE_3.70> sudo dnf versionlock add openview-reporter
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
hp performance agent DOWNGRADE
Affected: 4.70
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.70
1. Check installed version
apt-cache policy performance-agent || rpm -q performance-agent || performance-agent --version
2. No fixed release: DOWNGRADE to a release before 4.70 (Debian / Ubuntu)
apt-cache madison performance-agent sudo apt install performance-agent=<VERSION_BEFORE_4.70> sudo apt-mark hold performance-agent
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list performance-agent sudo dnf downgrade performance-agent-<VERSION_BEFORE_4.70> sudo dnf versionlock add performance-agent
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
hp reporter DOWNGRADE
Affected: 3.8
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.8
1. Check installed version
apt-cache policy reporter || rpm -q reporter || reporter --version
2. No fixed release: DOWNGRADE to a release before 3.8 (Debian / Ubuntu)
apt-cache madison reporter sudo apt install reporter=<VERSION_BEFORE_3.8> sudo apt-mark hold reporter
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list reporter sudo dnf downgrade reporter-<VERSION_BEFORE_3.8> sudo dnf versionlock add reporter
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2007-4349?

openview performance agent: downgrade or apply the listed mitigation; openview reporter: downgrade or apply the listed mitigation; performance agent: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2007-4349 being exploited?

CVE-2007-4349 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2007-4349 affect?

CVE-2007-4349 affects openview performance agent, openview reporter, performance agent. Severity is medium (CVSS 4.3). The Shared Trace Service (aka OVTrace) in HP Performance Agent C.04.70 (aka 4.70), HP OpenView Performance Agent C.04.60 and C.04.61, HP Reporter 3.8, and HP OpenView Reporter 3.7 (aka Report 3.70) allows remote attackers to cause a denial

How urgent is CVE-2007-4349?

Priority 37/100. No elevated risk signals yet.

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.