CVE-2007-6204
published 2007-12-13CVE-2007-6204: Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allow remote attackers to execute arbitrary code via…
PriorityP270critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
69.61%
99.3th percentile
Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allow remote attackers to execute arbitrary code via unspecified long arguments to (1) ovlogin.exe, (2) OpenView5.exe, (3) snmpviewer.exe, and (4) webappmon.exe, as demonstrated via a long Action parameter to OpenView5.exe.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x29\x4c\xe1\x77
- →Detect HTTP GET requests to /OvCgi/OpenView5.exe with an abnormally long Action parameter (5123+ bytes) indicative of stack buffer overflow exploitation. ↗
- →Payload bad characters for this exploit are null byte, colon, ampersand, question mark, percent, hash, space, CR, LF, forward slash, plus, vertical tab, and backslash — useful for tuning IDS/WAF signatures. ↗
- →The Metasploit module uses a return address from ov.dll (0x5a01d78d) for NNM 7.50 on Windows 2000; the PoC uses JMP ESP from user32.dll (0x77e14c29) on Win2kSP4 — monitor for these RET addresses in HTTP POST/GET bodies targeting OvCgi. ↗
- →Alert on HTTP GET requests to any of the four vulnerable CGI binaries (ovlogin.exe, OpenView5.exe, snmpviewer.exe, webappmon.exe) under /OvCgi/ with unusually long query string parameters. ↗
- →The exploit opens a reverse shell on port 4444; monitor for unexpected outbound connections from the HP OpenView server process to port 4444. ↗
- ·The Metasploit module targets specifically NNM 7.50 on Windows 2000 (all); the NVD advisory lists affected versions as 6.41, 7.01, and 7.51 — the return address (ov.dll) will differ across versions and platforms. ↗
- ·The Python PoC was tested only on NNM Release B.07.50 / Windows 2000 Server SP4; the JMP ESP address (0x77e14c29 from user32.dll) is specific to that OS/SP combination and will not be reliable on other targets. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'OpenView5.exe' CGI Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2007-6204 HP OpenView Network Node Manager (OV NNM) - 'OpenView5.exe' CGI Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'OpenView5.exe' CGI Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_openview5.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
By sending a specially crafted CGI request, an attacker may be able to execute
arbitrary code.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '
Exploit-DB
HP OpenView Network Node Manager 07.50 - CGI Remote Buffer Overflow
exploitdb·2007-12-12
CVE-2007-6204 HP OpenView Network Node Manager 07.50 - CGI Remote Buffer Overflow
HP OpenView Network Node Manager 07.50 - CGI Remote Buffer Overflow
---
#!/usr/bin/python
# HP OpenView Network Node Manager CGI Buffer Overflow
# Tested on NNM Release B.07.50 / Windows 2000 server SP4
# http://www.zerodayinitiative.com/advisories/ZDI-07-071.html
# Coded by Mati Aharoni
# muts|offensive-security|com
# http://www.offensive-security.com/0day/hpnnm.txt
# Notes:
# Vanilla stack based overflow
# I had no idea how to debug this...I ended up modifying the Openview5.exe binary by hijacking
# the entry point and injecting Sleep just before exe execution. This gave me enough
# time to attach a debugger before program termination. If anyone knows how to properly
# debug this, please tell me about it - there *must* be a better way...
#
# bt tools # ./sploit 192.168.1.105
# [+] Conn
Metasploit
HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow
metasploit
HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow
HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50. By sending a specially crafted CGI request, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01188923http://secunia.com/advisories/27964http://securityreason.com/securityalert/3441http://www.securityfocus.com/archive/1/484704/100/0/threadedhttp://www.securityfocus.com/bid/26741http://www.securitytracker.com/id?1019055http://www.vupen.com/english/advisories/2007/4111http://www.zerodayinitiative.com/advisories/ZDI-07-071.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/38892https://www.exploit-db.com/exploits/4724http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01188923http://secunia.com/advisories/27964http://securityreason.com/securityalert/3441http://www.securityfocus.com/archive/1/484704/100/0/threadedhttp://www.securityfocus.com/bid/26741http://www.securitytracker.com/id?1019055http://www.vupen.com/english/advisories/2007/4111http://www.zerodayinitiative.com/advisories/ZDI-07-071.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/38892https://www.exploit-db.com/exploits/4724
2007-12-13
Published