CVE-2009-4178
published 2009-12-10CVE-2009-4178: Heap-based buffer overflow in OvWebHelp.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code…
PriorityP272critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
74.02%
99.4th percentile
Heap-based buffer overflow in OvWebHelp.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long Topic parameter.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xDF\xf2\xe5\x77
- →Detect POST requests to /OvCgi/OvWebHelp.exe with an abnormally large Topic parameter (>57 bytes up to thousands of bytes) as the exploit trigger. ↗
- →The exploit sends a POST body with both 'Topic' and 'Target' parameters; large values in either field alongside Content-Type: application/x-www-form-urlencoded should be flagged. ↗
- →Payload bad characters for this vulnerability include null bytes and common URL metacharacters; encoded/alpha-mixed shellcode in the Topic parameter is a strong indicator. ↗
- →The Metasploit module uses a return address from ov.dll (0x5a01d78d); presence of this 4-byte sequence in POST body data targeting OvWebHelp.exe is a strong exploit indicator. ↗
- →The PoC exploit uses User-Agent 'BackTrack'; this combined with a POST to /OvCgi/OvWebHelp.exe is a high-confidence detection signal. ↗
- →The exploit targets C:\Program Files\HP OpenView\www\cgi-bin\ on Windows 2003 SP2; monitor process creation from OvWebHelp.exe spawning cmd.exe or other shells. ↗
- ·The Metasploit module return address (0x5a01d78d from ov.dll) is specific to HP OV NNM 7.50; the NVD advisory covers versions 7.01, 7.51, and 7.53, which may use different offsets. ↗
- ·The standalone PoC uses a kernel32.dll call-esp gadget (0x77e5f2df) tested on Windows 2003 SP2; this address will differ on other OS versions/patch levels. ↗
- ·The Metasploit module describes this as a stack buffer overflow while the NVD entry classifies it as a heap-based buffer overflow; detection logic should account for both overflow types. ↗
- ·Payload space is constrained to 650 bytes with numerous bad characters; URL-encoded or alpha-mixed shellcode encoding should be expected in the Topic parameter. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Buffer Overflow (Metasploit)
exploitdb·2010-11-11
CVE-2009-4178 HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_ovwebhelp.rb 10998 2010-11-11 22:43:22Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
By sending a specially crafted CGI request to OvWebHelp.exe, an attacker may be able to execute
arbitrary code.
},
'Author' => [ 'MC' ],
'License' => MSF_LICEN
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Topic Overflow
exploitdb·2010-03-30
CVE-2009-4178 HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Topic Overflow
HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Topic Overflow
---
#!/usr/bin/python
# Exploit title: HP OpenView NNM OvWebHelp.exe CGI Topic overflow
# Date: 2010.03.30
# Software link: hp.com
# Version: 7.53
# Tested on: Windows 2003 SP2
# CVE: 2009-4178
# Code:
############################################
# Trying 172.16.29.130...
# Connected to 172.16.29.130.
# Escape character is '^]'.
# Microsoft Windows [Version 5.2.3790]
# (C) Copyright 1985-2003 Microsoft Corp.
#
# C:\Program Files\HP OpenView\www\cgi-bin>
############################################
import struct
import socket
import httplib
import urllib
#[*] x86/alpha_mixed succeeded with size 746 (iteration=1)
sc =(
"\x89\xe3\xd9\xc3\xd9\x73\xf4\x5d\x55\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x4
Metasploit
HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow
metasploit
HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow
HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50. By sending a specially crafted CGI request to OvWebHelp.exe, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://dvlabs.tippingpoint.com/advisory/TPTI-09-11http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877http://marc.info/?l=bugtraq&m=126046355120442&w=2http://www.securityfocus.com/archive/1/508354/100/0/threadedhttp://www.securityfocus.com/bid/37261http://www.securityfocus.com/bid/37340https://exchange.xforce.ibmcloud.com/vulnerabilities/54659http://dvlabs.tippingpoint.com/advisory/TPTI-09-11http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877http://marc.info/?l=bugtraq&m=126046355120442&w=2http://www.securityfocus.com/archive/1/508354/100/0/threadedhttp://www.securityfocus.com/bid/37261http://www.securityfocus.com/bid/37340https://exchange.xforce.ibmcloud.com/vulnerabilities/54659
2009-12-10
Published