CVE-2008-1697
published 2008-04-08CVE-2008-1697: Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53, 7.51, and earlier allows remote attackers to execute arbitrary…
PriorityP269critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
74.34%
99.4th percentile
Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53, 7.51, and earlier allows remote attackers to execute arbitrary code via a long URI in an HTTP request processed by ovas.exe, as demonstrated by a certain topology/homeBaseView request. NOTE: some of these details are obtained from third party information.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | <= 7.53 | — |
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
alert tcp $EXTERNAL_NET any -> $HOME_NET 7510 (msg:"WEB-MISC HP OpenView Network Node Manager HTTP handling buffer overflow attempt"; flow:to_server,established; content:"GET "; depth:4; nocase; isdataat:165,relative; content:"/topology/homeBaseView"; pcre:"/GET\s+\w[^\x0a\x20]{165}/i"; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,28569; reference:cve,2008-1697; classtype:attempted-admin; sid:13715; rev:3;)bytes↗
T00WT00W
- →Detect exploit attempts by matching HTTP GET requests to port 7510 with URI path /topology/homeBaseView where the URI segment before the path exceeds 165 characters (no newline or space), as codified in Snort SID 13715. ↗
- →The Metasploit module bypasses the above Snort rule; monitor for any oversized HTTP GET URI on port 7510 targeting /topology/home or /topology/homeBaseView regardless of length threshold. ↗
- →Look for the egghunter egg marker 'T00WT00W' in HTTP POST body data sent to port 7510 — this is the egg tag prepended to the alphanumeric-encoded bind shellcode. ↗
- →Version fingerprinting probe: attacker GETs /topology/home and checks response body for 'NNM Release B.07.53', 'NNM Release B.07.52', or 'NNM Release B.07.51' to auto-select exploit target. ↗
- →The Metasploit module sets InitialAutoRunScript to 'migrate -f', so post-exploitation process migration away from ovas.exe is expected; watch for ovas.exe spawning or injecting into other processes. ↗
- →HTTP Content-Length header value of 1048580 in requests to port 7510 is a strong indicator of the original PoC exploit payload delivery. ↗
- ·The Metasploit module explicitly states it was designed to bypass Snort SID 13715 (web-misc.rules); relying solely on that rule is insufficient for detection. ↗
- ·The exploit uses alphanumeric-encoded egghunter shellcode to bypass character restrictions (\x40, \x3f, \x3a, \x2f are restricted); signature-based detection must account for alphanumeric-only shellcode patterns. ↗
- ·The WfsDelay is set to 45 seconds to allow the egghunter time to locate the egg in memory; detection logic should account for delayed payload execution rather than expecting immediate shell activity. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) 7.53/7.51 - 'OVAS.exe' Stack Buffer Overflow (Metasploit)
exploitdb·2010-10-12
CVE-2008-1697 HP OpenView Network Node Manager (OV NNM) 7.53/7.51 - 'OVAS.exe' Stack Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) 7.53/7.51 - 'OVAS.exe' Stack Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_ovas.rb 10660 2010-10-12 18:39:21Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
##
# This should bypass the following snort rule referenced from web-misc.rules (10/17/2008)
# alert tcp $EXTERNAL_NET any -> $HOME_NET 7510 (msg:"WEB-MISC HP OpenView Network Node Manager HTTP handling buffer overflow attempt"; flow:to_server,established; content:"GET "; depth:4; nocase; isdataat:165,relative; content:"/topology/homeBaseView"; pcre:"/GET\s+\w[^\x0a\x20]
Exploit-DB
HP OpenView Network Node Manager (OV NNM) 7.5.1 - 'OVAS.exe' Overflow (SEH)
exploitdb·2008-04-02
CVE-2008-1697 HP OpenView Network Node Manager (OV NNM) 7.5.1 - 'OVAS.exe' Overflow (SEH)
HP OpenView Network Node Manager (OV NNM) 7.5.1 - 'OVAS.exe' Overflow (SEH)
---
#!/usr/bin/python
################################################################################
# HP OpenView NNM 7.5.1 OVAS.EXE Pre Authentication SEH Overflow
# Tested on Windows 2003 Server SP1.
# Coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/hp-nnm-ov.py.txt
# [shameless plug]
# This vulnerability was found, analysed and exploited
# as part of a training module in "BackTrack to the Max".
# http://www.offensive-security.com/ilt.php
# [/shameless plug]
#################################################################################
# bt 0day# python hp-nnm-ov.py
# [*] HP NNM 7.5.1 OVAS.exe SEH PRE AUTH Overflow Exploit (0day)
# [*] http://www.offensive
Metasploit
HP OpenView NNM 7.53, 7.51 OVAS.EXE Pre-Authentication Stack Buffer Overflow
metasploit
HP OpenView NNM 7.53, 7.51 OVAS.EXE Pre-Authentication Stack Buffer Overflow
HP OpenView NNM 7.53, 7.51 OVAS.EXE Pre-Authentication Stack Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager versions 7.53 and earlier. Specifically this vulnerability is caused by a failure to properly handle user supplied input within the HTTP request including headers and the actual URL GET request. Exploitation is tricky due to character restrictions. It was necessary to utilize a egghunter shellcode which was alphanumeric encoded by muts in the original exploit. If you plan on using exploit this for a remote shell, you will likely want to migrate to a different process as soon as possible. Any connections get reset after a short period of time. This is probably some timeout handling code that causes this.
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=121553626110871&w=2http://secunia.com/advisories/29641http://www.offensive-security.com/0day/hp-nnm-ov.py.txthttp://www.securityfocus.com/bid/28569http://www.securitytracker.com/id?1019782http://www.vupen.com/english/advisories/2008/1085/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41600https://www.exploit-db.com/exploits/5342http://marc.info/?l=bugtraq&m=121553626110871&w=2http://secunia.com/advisories/29641http://www.offensive-security.com/0day/hp-nnm-ov.py.txthttp://www.securityfocus.com/bid/28569http://www.securitytracker.com/id?1019782http://www.vupen.com/english/advisories/2008/1085/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41600https://www.exploit-db.com/exploits/5342
2008-04-08
Published