CVE-2010-1960
published 2010-06-10CVE-2010-1960: Buffer overflow in the error handling functionality in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to…
PriorityP273critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
67.32%
99.3th percentile
Buffer overflow in the error handling functionality in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long, invalid option to jovgraph.exe.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x89\xe2\xdb\xdb\xd9\x72\xf4\x59\x83\xe9\xf7
- →Detect HTTP POST requests to /OvCgi/jovgraph.exe with an 'arg' parameter value exceeding 10240 bytes that begins with a dash character. ↗
- →Look for the static string 'Unrecognized option: ' prepended to the oversized arg parameter in POST body traffic to jovgraph.exe — this is the trigger string for the vulnerable code path. ↗
- →The exploit overwrites the SEH chain at offset 0x2cb0 (11440 bytes) into the buffer; monitor for SEH-based exploitation patterns in NNM CGI requests. ↗
- →The exploit uses the Alpha2 encoder with a double-backward jump; look for alphanumeric shellcode in POST bodies to /OvCgi/jovgraph.exe. ↗
- →Check for the FPU-based EIP-to-ECX stub bytes (89 e2 db db d9 72 f4 59 83 e9 f7) in HTTP POST payloads targeting NNM CGI endpoints. ↗
- →The exploit uses EXITFUNC=process and targets Windows; a successful exploitation results in no HTTP response (502 is unexpected), which can be used as a post-exploitation indicator. ↗
- ·The ROP gadget (pop edx/pop ebp/ret at 0x5a238ba7) is specific to ovsnmp.dll version 1.30.10.9166; different patch levels will have different addresses. ↗
- ·The vulnerability affects ovwebsnmpsrv.exe with a file timestamp prior to April 7th, 2010; patched versions (NNM_01203 and later) are not vulnerable. ↗
- ·Bad characters for payload include null bytes, control characters, space, '!', '"', '$', ',', ';', '<', '>', and backtick — payloads containing these will fail. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'ovwebsnmpsrv.exe' Unrecognized Option Buffer Overflow (Metasploit)
exploitdb·2011-03-23
CVE-2010-1960 HP OpenView Network Node Manager (OV NNM) - 'ovwebsnmpsrv.exe' Unrecognized Option Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'ovwebsnmpsrv.exe' Unrecognized Option Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_ovwebsnmpsrv_uro.rb 12095 2011-03-23 15:43:25Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HEAD', :uri => '/OvCgi/jovgraph.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow',
'D
Metasploit
HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow
metasploit
HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow
HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code is within the option parsing function within "ovwebsnmpsrv.exe" with a timestamp prior to April 7th, 2010. Reaching the vulnerable code requires a 'POST' request with an 'arg' parameter that, when combined with some static text, exceeds 10240 bytes. The parameter must begin with a dash. It is important to note that this vulnerability must be exploited by overwriting SEH. This is since overflowing the buffer with control
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=127602909915281&w=2http://secunia.com/advisories/40101http://www.securityfocus.com/archive/1/511734/100/0/threadedhttp://www.securityfocus.com/bid/40637http://www.securitytracker.com/id?1024071http://www.zerodayinitiative.com/advisories/ZDI-10-105/https://exchange.xforce.ibmcloud.com/vulnerabilities/59249http://marc.info/?l=bugtraq&m=127602909915281&w=2http://secunia.com/advisories/40101http://www.securityfocus.com/archive/1/511734/100/0/threadedhttp://www.securityfocus.com/bid/40637http://www.securitytracker.com/id?1024071http://www.zerodayinitiative.com/advisories/ZDI-10-105/https://exchange.xforce.ibmcloud.com/vulnerabilities/59249
2010-06-10
Published