CVE-2007-2280
published 2009-12-18CVE-2007-2280: Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data…
PriorityP273critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
60.29%
99.0th percentile
Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via an MSG_PROTOCOL command with long arguments, a different vulnerability than CVE-2009-3844.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_storage_data_protector | — | — |
| hp | openview_storage_data_protector | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xff\xfe (Unicode BOM) followed by Rex::Text.to_unicode("267") as MSG_PROTOCOL command value- →Monitor TCP port 5555 for inbound connections to OmniInet.exe; exploit traffic begins with a 4-byte big-endian packet length field followed by a Unicode BOM (0xFF 0xFE) and a Unicode-encoded MSG_PROTOCOL command value '267'. ↗
- →The exploit uses SEH-based exploitation (EXITFUNC=seh); look for structured exception handler overwrites in crash dumps of OmniInet.exe with return addresses matching known p/p/r gadgets: 0x004406cf, 0x0044327d, 0x004280ff, or 0x004412ed. ↗
- →The vulnerability is triggered by two consecutive wcscpy() calls in OmniInet.exe; crash analysis showing stack smash in wcscpy within OmniInet.exe on port 5555 is a strong indicator of exploitation. ↗
- →Version fingerprinting: the service responds to an initial probe with a banner containing 'HP Data Protector', 'HP OpenView Storage Data Protector', or 'HP StorageWorks Application Recovery Manager'; versions prior to 6.11 are vulnerable. ↗
- ·The Metasploit module payload space is tightly constrained; the bad character list excludes only null bytes (\x00), meaning any payload must avoid embedded null bytes to prevent premature string termination in the wcscpy() overflow path. ↗
- ·The module only exploits the first of two consecutive wcscpy() calls; the second overflow (tracked separately as CVE-2009-3844) is not covered by this exploit module. ↗
- ·Automatic target detection relies on the banner response from OmniInet.exe; if the service does not return a recognizable banner, the module raises a RuntimeError and will not proceed. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP - 'OmniInet.exe' MSG_PROTOCOL Buffer Overflow (Metasploit) (2)
exploitdb·2010-09-20
CVE-2007-2280 HP - 'OmniInet.exe' MSG_PROTOCOL Buffer Overflow (Metasploit) (2)
HP - 'OmniInet.exe' MSG_PROTOCOL Buffer Overflow (Metasploit) (2)
---
##
# $Id: hp_omniinet_1.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HP OmniInet.exe MSG_PROTOCOL Buffer Overflow',
'Description' => %q{
This module exploits a stack-based buffer overflow in the Hewlett-Packard
OmniInet NT Service. By sending a specially crafted MSG_PROTOCOL (0x010b)
packet, a remote attacker may be able to execute arbitrary code with elevated
privileges.
This service is installed with HP OpenView Data Protector
Metasploit
HP OmniInet.exe MSG_PROTOCOL Buffer Overflow
metasploit
HP OmniInet.exe MSG_PROTOCOL Buffer Overflow
HP OmniInet.exe MSG_PROTOCOL Buffer Overflow
This module exploits a stack-based buffer overflow in the Hewlett-Packard OmniInet NT Service. By sending a specially crafted MSG_PROTOCOL (0x010b) packet, a remote attacker may be able to execute arbitrary code with elevated privileges. This service is installed with HP OpenView Data Protector, HP Application Recovery Manager and potentially other products. This exploit has been tested against versions 6.1, 6.0, and 5.50 of Data Protector. and versions 6.0 and 6.1 of Application Recovery Manager. NOTE: There are actually two consecutive wcscpy() calls in the program (which may be why ZDI considered them two separate issues). However, this module only exploits the first one.
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=126106261622540&w=2http://securitytracker.com/id?1023361http://www.securityfocus.com/bid/37396http://www.vupen.com/english/advisories/2009/3594http://www.zerodayinitiative.com/advisories/ZDI-09-099/http://marc.info/?l=bugtraq&m=126106261622540&w=2http://securitytracker.com/id?1023361http://www.securityfocus.com/bid/37396http://www.vupen.com/english/advisories/2009/3594http://www.zerodayinitiative.com/advisories/ZDI-09-099/
2009-12-18
Published