CVE-2009-4179
published 2009-12-10CVE-2009-4179: Stack-based buffer overflow in ovalarm.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code…
PriorityP276critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
66.97%
99.3th percentile
Stack-based buffer overflow in ovalarm.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Accept-Language header in an OVABverbose action.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow Attempt"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/OvCgi/ovalarm.exe"; nocase; fast_pattern; content:"OVABverbose="; nocase; distance:0; pcre:"/^(1|on|true)/Ri"; http.accept_lang; isdataat:100,relative; reference:cve,2009-4179; classtype:web-application-attack; sid:2010704; rev:10; metadata:created_at 2010_07_30, cve CVE_2009_4179, confidence Low, signature_severity Major, updated_at 2020_11_07;)
bytes↗
eb 03 59 eb 05 e8 f8 ff ff ff 4f 49 49 49 49 49 49 51 5a 56 54 58 36 33 30 56 58 34 41 30 42 36
- →Trigger condition: HTTP GET to /OvCgi/ovalarm.exe with OVABverbose set to 'on', 'true', or '1' AND an Accept-Language header longer than 100 bytes. Both conditions must be present simultaneously. ↗
- →The Snort/Suricata rule uses isdataat:100,relative on the http.accept_lang buffer to detect Accept-Language headers exceeding 100 bytes, which is the overflow threshold. ↗
- →The exploit format string prefix '@@ isWide: comparing '' may appear in logs or memory dumps as a marker of exploitation attempt. ↗
- →Alternative exploit vector uses the OvAcceptLang cookie (instead of Accept-Language header) to deliver the overflow buffer, combined with OVABverbose=POST in the cookie. ↗
- →The exploit was tested successfully with a reverse_ord_tcp payload; monitor for unexpected outbound connections from the ovalarm.exe/IIS process, particularly to port 4444. ↗
- →Return address 0x5a212a4a (jmp esp in ov.dll) and 0x71c02b67 (push esp/ret in ws2_32.dll) are used as EIP overwrite targets; presence of these values in network traffic is a strong indicator of exploitation. ↗
- ·The Metasploit module payload space is limited to 650 bytes, bad characters include all bytes 0x00–0x1f, and the encoder requires AlphanumMixed with BufferRegister=ESP. Payloads outside these constraints will not work with the standard module. ↗
- ·The Emerging Threats Snort rule (sid:2010704) is rated confidence Low, meaning it may produce false positives and should be tuned before use in blocking mode. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SERVER Possible HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow Attempt
suricata·2010-07-30
CVE-2009-4179 ET WEB_SERVER Possible HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow Attempt
ET WEB_SERVER Possible HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow Attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow Attempt"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/OvCgi/ovalarm.exe"; nocase; fast_pattern; content:"OVABverbose="; nocase; distance:0; pcre:"/^(1|on|true)/Ri"; http.accept_lang; isdataat:100,relative; reference:cve,2009-4179; classtype:web-application-attack; sid:2010704; rev:10; metadata:created_at 2010_07_30, cve CVE_2009_4179, confidence Low, signature_severity Major, updated_at 2020_11_07;)
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'ovalarm.exe' CGI Buffer Overflow (Metasploit)
exploitdb·2010-11-11
CVE-2009-4179 HP OpenView Network Node Manager (OV NNM) - 'ovalarm.exe' CGI Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'ovalarm.exe' CGI Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_ovalarm_lang.rb 10998 2010-11-11 22:43:22Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53.
By sending a specially crafted CGI request to ovalarm.exe, an attacker can execute
arbitrary code.
This specific vulnerability is due to a call to "sprintf_new
Exploit-DB
HP OpenView Network Node Manager (OV NNM) 7.53 - 'ovalarm.exe' CGI Remote Buffer Overflow
exploitdb·2009-12-12
CVE-2009-4179 HP OpenView Network Node Manager (OV NNM) 7.53 - 'ovalarm.exe' CGI Remote Buffer Overflow
HP OpenView Network Node Manager (OV NNM) 7.53 - 'ovalarm.exe' CGI Remote Buffer Overflow
---
#!/usr/bin/python
# HP NNP ovalarm.exe CGI Remote Buffer Overflow - Pre Authentication
# Tested on XP SP3 + IIS + NNM Release B.07.50
# Authors: muts & sinn3r (x90.sinner {a.t} gmail.c0m)
# Reference: http://dvlabs.tippingpoint.com/advisory/TPTI-09-12
# http://www.offensive-security.com/0day/exploit-nnm-ovalarm.py.txt
#
# ** Big thanks to dookie for identifying the problem & testing for us! **
#
# IMPORTANT: How to recreate the vulnerable state:
# 1. Download NNM from exploit-db.com, install it
# 2. Go to Start -> All Programs -> HP OpenView Patches -> OpenView Network Node Manager 7.51 -> run "NNM_01187 Uninstall". And then reboot.
# 3. After the patch is removed, open command prompt, go to C:\
Metasploit
HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow
metasploit
HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow
HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a specially crafted CGI request to ovalarm.exe, an attacker can execute arbitrary code. This specific vulnerability is due to a call to "sprintf_new" in the "isWide" function within "ovalarm.exe". A stack buffer overflow occurs when processing an HTTP request that contains the following. 1. An "Accept-Language" header longer than 100 bytes 2. An "OVABverbose" URI variable set to "on", "true" or "1" The vulnerability is related to "_WebSession::GetWebLocale()". NOTE: This exploit has been tested successfully with a reverse_ord_tcp payload.
No writeups or analysis indexed.
http://dvlabs.tippingpoint.com/advisory/TPTI-09-12http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877http://marc.info/?l=bugtraq&m=126046355120442&w=2http://www.securityfocus.com/archive/1/508355/100/0/threadedhttp://www.securityfocus.com/bid/37261http://www.securityfocus.com/bid/37347https://exchange.xforce.ibmcloud.com/vulnerabilities/54657http://dvlabs.tippingpoint.com/advisory/TPTI-09-12http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877http://marc.info/?l=bugtraq&m=126046355120442&w=2http://www.securityfocus.com/archive/1/508355/100/0/threadedhttp://www.securityfocus.com/bid/37261http://www.securityfocus.com/bid/37347https://exchange.xforce.ibmcloud.com/vulnerabilities/54657
2009-12-10
Published