CVE-2008-3544

published 2008-10-13

CVE-2008-3544: Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, and possibly 7.01, 7.50, and 7.53, allow remote…

Priority P2 63 critical 9 CVSS 2.0

AV N AC L Au N C P I P A C

EXPLOIT

Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, and possibly 7.01, 7.50, and 7.53, allow remote attackers to execute arbitrary code via a long (1) REQUEST_SEV_CHANGE (aka number 47), (2) REQUEST_SAVE_STATE (aka number 61), or (3) REQUEST_RESTORE_STATE (aka number 62) request to TCP port 2954.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
hp	openview_network_node_manager	—	—
hp	openview_network_node_manager	—	—
hp	openview_network_node_manager	—	—
hp	openview_network_node_manager	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 2953↗

port 2954↗

command echo %n%n%s%n%n%s | nc SERVER 2953 -v -v↗

command echo 62 AAAAAAAAAAAAA...512_'A's...AAAAAAAAAAAAA | nc SERVER 2954 -v -v↗

command echo 47 1 2 what_you_want | nc SERVER 2954 -v -v -w 1↗

process ovalarmsrv.exe↗

• → Detect format string attack payload sent to TCP port 2953 targeting ovalarmsrv; look for format specifiers such as %n and %s in the request stream ↗
• → Detect stack-based buffer overflow attempts on TCP port 2954 via REQUEST_RESTORE_STATE (opcode 62) with a string parameter longer than 512 bytes ↗
• → Monitor for ovalarmsrv process consuming CPU at 100% following receipt of invalid values on ports 2953/2954, indicating a denial-of-service condition ↗
• → Alert on the error string 'Connection Refused; Data in listener port corrupt:' appearing in logs, which reflects the format string vulnerability trigger path in ovalarmsrv ↗

• · Affected versions include OV NNM 7.51 (confirmed) and possibly 7.01, 7.50, and 7.53; the exploit-db PoC targets 7.53 specifically ↗
• · No vendor fix was available at the time of disclosure (2008-04-07) ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119