CVE-2010-1552
published 2010-05-13CVE-2010-1552: Stack-based buffer overflow in the doLoad function in snmpviewer.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers…
PriorityP275critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
68.89%
99.3th percentile
Stack-based buffer overflow in the doLoad function in snmpviewer.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via the act and app parameters.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x89\xe2\xdb\xdb\xd9\x72\xf4\x59\x83\xe9\xf7
- →Detect HTTP GET or POST requests to /OvCgi/snmpviewer.exe containing both 'act' and 'app' parameters with combined length exceeding 1024 bytes, which triggers the stack buffer overflow. ↗
- →The exploit overwrites the Structured Exception Handler (SEH) at offset 1192 within the overflow buffer; look for abnormally large act/app parameter values in requests to snmpviewer.exe. ↗
- →The 'ins' parameter in requests to snmpviewer.exe will be set to either 'load' or 'content' during exploitation; filter for these values alongside oversized act/app parameters. ↗
- →The exploit error response string 'The specified Application/Action name is not defined.Application:"' is used as a marker to calculate SEH jump distances; its presence in server responses may indicate active exploitation attempts. ↗
- →Look for use of the ROP gadget address 0x5a238ba7 (pop edx/pop ebp/ret in ovsnmp.dll v1.30.10.9166) or 0x71c069dd (pop edx/pop ecx/ret in ws2_32.dll v5.2.3790.3959) in memory or shellcode targeting HP NNM systems. ↗
- ·The vulnerability is only present in snmpviewer.exe with a timestamp prior to April 7th, 2010; patched versions (NNM_01203 and later) are not affected. ↗
- ·Affected versions are HP OV NNM 7.01, 7.51, and 7.53 only; the Metasploit module specifically targets 7.53 w/NNM_01201 and 7.53 on Windows 2003 with distinct ROP gadget addresses per target. ↗
- ·The payload space is constrained to 1024 bytes and several bad characters must be avoided, including null bytes, control characters, and special HTML/shell characters (0x21, 0x26, 0x3c, 0x3e, 0x5b, 0x5d, 0x5e, 0x60, 0x7e, 0x7f). ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'snmpviewer.exe' Remote Buffer Overflow (Metasploit)
exploitdb·2011-03-23
CVE-2010-1552 HP OpenView Network Node Manager (OV NNM) - 'snmpviewer.exe' Remote Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'snmpviewer.exe' Remote Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_snmpviewer_actapp.rb 12098 2011-03-23 15:47:20Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HEAD', :uri => '/OvCgi/snmpviewer.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow',
'Description' => %q{
This module exp
Metasploit
HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow
metasploit
HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow
HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01203. By making a specially crafted HTTP request to the "snmpviewer.exe" CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code lies within a function within "snmpviewer.exe" with a timestamp prior to April 7th, 2010. This vulnerability is triggerable via either a GET or POST request. The request must contain 'act' and 'app' parameters which, when combined, total more than the 1024 byte stack buffer can hold. It is important to note that this vulnerability must be exploited by overwriting SEH. While the saved return address can be smashed, a function call that occurs bef
http://marc.info/?l=bugtraq&m=127360750704351&w=2http://securityreason.com/securityalert/8157http://www.securityfocus.com/archive/1/511248/100/0/threadedhttp://zerodayinitiative.com/advisories/ZDI-10-083/http://marc.info/?l=bugtraq&m=127360750704351&w=2http://securityreason.com/securityalert/8157http://www.securityfocus.com/archive/1/511248/100/0/threadedhttp://zerodayinitiative.com/advisories/ZDI-10-083/
2010-05-13
Published