cbcvebase.
CVE-2008-3544
published 2008-10-13

CVE-2008-3544: Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, and possibly 7.01, 7.50, and 7.53, allow remote…

PriorityP263critical9CVSS 2.0
AVNACLAuNCPIPAC
EXPLOIT
EPSS
18.04%
96.9th percentile
Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, and possibly 7.01, 7.50, and 7.53, allow remote attackers to execute arbitrary code via a long (1) REQUEST_SEV_CHANGE (aka number 47), (2) REQUEST_SAVE_STATE (aka number 61), or (3) REQUEST_RESTORE_STATE (aka number 62) request to TCP port 2954.

Affected

4 ranges
VendorProductVersion rangeFixed in
hpopenview_network_node_manager——
hpopenview_network_node_manager——
hpopenview_network_node_manager——
hpopenview_network_node_manager——

Detection & IOCsextracted from sources · hover to see the quote

port2953↗
port2954↗
commandecho %n%n%s%n%n%s | nc SERVER 2953 -v -v↗
commandecho 62 AAAAAAAAAAAAA...512_'A's...AAAAAAAAAAAAA | nc SERVER 2954 -v -v↗
commandecho 47 1 2 what_you_want | nc SERVER 2954 -v -v -w 1↗
processovalarmsrv.exe↗
  • →Detect format string attack payload sent to TCP port 2953 targeting ovalarmsrv; look for format specifiers such as %n and %s in the request stream ↗
  • →Detect stack-based buffer overflow attempts on TCP port 2954 via REQUEST_RESTORE_STATE (opcode 62) with a string parameter longer than 512 bytes ↗
  • →Monitor for ovalarmsrv process consuming CPU at 100% following receipt of invalid values on ports 2953/2954, indicating a denial-of-service condition ↗
  • →Alert on the error string 'Connection Refused; Data in listener port corrupt:' appearing in logs, which reflects the format string vulnerability trigger path in ovalarmsrv ↗
  • ·Affected versions include OV NNM 7.51 (confirmed) and possibly 7.01, 7.50, and 7.53; the exploit-db PoC targets 7.53 specifically ↗
  • ·No vendor fix was available at the time of disclosure (2008-04-07) ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.