CVE-2008-0067
published 2009-01-08CVE-2008-0067: Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via…
PriorityP269critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
63.42%
99.1th percentile
Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) long string parameters to the OpenView5.exe CGI program; (2) a long string parameter to the OpenView5.exe CGI program, related to ov.dll; or a long string parameter to the (3) getcvdata.exe, (4) ovlaunch.exe, or (5) Toolbar.exe CGI program.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | network_node_manager | — | — |
| hp | network_node_manager | — | — |
| hp | network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit sends a GET request to /OvCgi/Toolbar.exe with a query string of 5108+ random uppercase alpha characters followed by a 4-byte return address — look for abnormally long CGI query strings to this endpoint. ↗
- →The exploit targets ov.dll for its return address (ROP gadget at 0x5a01d78d); presence of this address in HTTP traffic or memory is a strong indicator of exploitation. ↗
- →Additional vulnerable CGI endpoints on the same OvCgi path include getcvdata.exe, ovlaunch.exe, and OpenView5.exe — monitor all for oversized query string parameters. ↗
- →Payload bad characters include null bytes and common URL metacharacters; the exploit uses only uppercase alpha padding, so a query string of 5000+ uppercase letters to Toolbar.exe is highly suspicious. ↗
- ·The Metasploit module targets specifically HP OV NNM 7.50 on Windows 2000; the return address (0x5a01d78d in ov.dll) is version-specific and will not work against 7.01 or 7.53 without adjustment. ↗
- ·The CVE covers multiple affected CGI programs (OpenView5.exe, getcvdata.exe, ovlaunch.exe, Toolbar.exe); detection rules should cover all endpoints, not just Toolbar.exe. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jv86-ffgr-4446: Stack-based buffer overflow in OvCgi/Toolbar
ghsa_unreviewed·2022-05-02·CVSS 10.0
CVE-2009-0920 [CRITICAL] CWE-119 GHSA-jv86-ffgr-4446: Stack-based buffer overflow in OvCgi/Toolbar
Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long OvOSLocale cookie, a variant of CVE-2008-0067.
GHSA
GHSA-5g96-4fvw-4f29: Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7
ghsa_unreviewed·2022-05-01
CVE-2008-0067 [HIGH] CWE-119 GHSA-5g96-4fvw-4f29: Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7
Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) long string parameters to the OpenView5.exe CGI program; (2) a long string parameter to the OpenView5.exe CGI program, related to ov.dll; or a long string parameter to the (3) getcvdata.exe, (4) ovlaunch.exe, or (5) Toolbar.exe CGI program.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'Toolbar.exe' CGI Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2008-0067 HP OpenView Network Node Manager (OV NNM) - 'Toolbar.exe' CGI Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'Toolbar.exe' CGI Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_toolbar.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
By sending a specially crafted CGI request to Toolbar.exe, an attacker may be able to execute
arbitrary code.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Vers
Metasploit
HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow
metasploit
HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow
HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50. By sending a specially crafted CGI request to Toolbar.exe, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=123247393715913&w=2http://secunia.com/advisories/28074http://secunia.com/secunia_research/2008-13/http://securityreason.com/securityalert/4885http://securityreason.com/securityalert/8307http://securitytracker.com/id?1021521http://www.securityfocus.com/archive/1/499826/100/0/threadedhttp://www.securityfocus.com/bid/33147http://marc.info/?l=bugtraq&m=123247393715913&w=2http://secunia.com/advisories/28074http://secunia.com/secunia_research/2008-13/http://securityreason.com/securityalert/4885http://securityreason.com/securityalert/8307http://securitytracker.com/id?1021521http://www.securityfocus.com/archive/1/499826/100/0/threadedhttp://www.securityfocus.com/bid/33147
2009-01-08
Published