CVE-2009-3849
published 2009-12-10CVE-2009-3849: Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via…
PriorityP274critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
73.69%
99.5th percentile
Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long Template parameter to nnmRptConfig.exe, related to the strcat function; or (2) a long Oid parameter to snmp.exe.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
ff e4 00 00 83 c4 08 85 c0 75 14 68 18 2f 04 5a
- →EIP control occurs at offset 5123 bytes into the Oid parameter; monitor for GET requests to /OvCgi/Main/Snmp.exe with an Oid parameter value exceeding 5123 bytes. ↗
- →The exploit sends a GET request with query parameters Host=, Oid=<long string>, Community=, Action=, Context=Snmp — alert on abnormally long Oid values in requests to Snmp.exe. ↗
- →Payload bad characters for this exploit are null, colon, ampersand, question mark, percent, hash, space, CR, LF, forward-slash, plus, vertical-tab, backslash — use these to tune IDS signatures. ↗
- →The return address used targets ov.dll at 0x5a01d78d (jmp esp); presence of this address in network traffic or memory indicates exploitation of HP OV NNM 7.50 on Windows 2000. ↗
- →Stack adjustment of -3500 bytes is applied before shellcode execution; unusual ESP manipulation of this magnitude in the context of Snmp.exe is a strong exploitation indicator. ↗
- ·The Metasploit module targets only HP OV NNM 7.50 on Windows 2000; the return address (0x5a01d78d in ov.dll) is version-specific and will not work against NNM 7.01 or 7.53 without adjustment. ↗
- ·The module author notes the jmp esp gadget is for 7.53 and will be updated, indicating the same offset/gadget may differ across minor versions. ↗
- ·Payload space is limited to 650 bytes; staged or large payloads will not fit within the overflow buffer without modification. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'Snmp.exe' CGI Buffer Overflow (Metasploit)
exploitdb·2010-11-11
CVE-2009-3849 HP OpenView Network Node Manager (OV NNM) - 'Snmp.exe' CGI Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'Snmp.exe' CGI Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_snmp.rb 10998 2010-11-11 22:43:22Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
By sending a specially crafted CGI request to Snmp.exe, an attacker may be able to execute
arbitrary code.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$R
Metasploit
HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow
metasploit
HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow
HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50. By sending a specially crafted CGI request to Snmp.exe, an attacker may be able to execute arbitrary code.
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877http://marc.info/?l=bugtraq&m=126046355120442&w=2http://www.securityfocus.com/archive/1/508348/100/0/threadedhttp://www.securityfocus.com/archive/1/508349/100/0/threadedhttp://www.securityfocus.com/bid/37261http://www.securityfocus.com/bid/37298http://www.securityfocus.com/bid/37299http://zerodayinitiative.com/advisories/ZDI-09-095/http://zerodayinitiative.com/advisories/ZDI-09-097/https://exchange.xforce.ibmcloud.com/vulnerabilities/54652https://exchange.xforce.ibmcloud.com/vulnerabilities/54654http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877http://marc.info/?l=bugtraq&m=126046355120442&w=2http://www.securityfocus.com/archive/1/508348/100/0/threadedhttp://www.securityfocus.com/archive/1/508349/100/0/threadedhttp://www.securityfocus.com/bid/37261http://www.securityfocus.com/bid/37298http://www.securityfocus.com/bid/37299http://zerodayinitiative.com/advisories/ZDI-09-095/http://zerodayinitiative.com/advisories/ZDI-09-097/https://exchange.xforce.ibmcloud.com/vulnerabilities/54652https://exchange.xforce.ibmcloud.com/vulnerabilities/54654
2009-12-10
Published