CVE-2010-1961
published 2010-06-10CVE-2010-1961: Buffer overflow in ovutil.dll in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code…
PriorityP274critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
69.11%
99.3th percentile
Buffer overflow in ovutil.dll in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unspecified variables to jovgraph.exe, which are not properly handled in a call to the sprintf function.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x81\xc4\x54\xf2\xff\xff
- →Detect HTTP GET or POST requests to /OvCgi/jovgraph.exe with an abnormally long 'arg' parameter (>256 bytes) — the overflow buffer for CVE-2010-1961 is 256 bytes, so payloads will substantially exceed this. ↗
- →The exploit requires 'sel' and 'act' parameters to be set, and 'timestamp' must NOT be set. Requests to jovgraph.exe with sel+act+arg but no timestamp and a very long arg are highly suspicious. ↗
- →The exploit prepends the stack-pivot stub \x81\xc4\x54\xf2\xff\xff (ADD ESP,-3500) to the payload. Scanning HTTP POST/GET bodies to jovgraph.exe for this byte sequence is a high-fidelity indicator. ↗
- →The exploit payload bad-chars exclude null, tab, LF, CR, space, double-quote, $, comma, semicolon, and backtick. A long 'arg' value free of these characters in a request to jovgraph.exe is characteristic of this exploit. ↗
- →Monitor ovwebsnmpsrv.exe for unexpected child processes or crashes; the vulnerable code path is triggered via the getProxiedStorageAddress function in ovutil.dll when processing the 'arg' CGI parameter. ↗
- ·CVE-2010-1961 (ovutil overflow) and CVE-2010-1964 (main SEH overflow) share the same attack vector (/OvCgi/jovgraph.exe with a long 'arg'). The key differentiator is that CVE-2010-1961 overwrites the saved return address (not SEH), while CVE-2010-1964 requires SEH overwrite. Detection rules targeting the URI/parameter length will fire for both CVEs. ↗
- ·The exploit notes unreliability possibly related to OVWDB or session management, meaning exploit attempts may not always produce a clean crash or session — detection based solely on process crash may miss some attempts. ↗
- ·The ROP/return gadget addresses (0x5a02aadf in ov.dll, 0x5a219880 in ovsnmp.dll, 0x71c069dd in ws2_32.dll) are version-specific. Signature-based detection on these hardcoded addresses will only match the Metasploit module targeting NNM 7.53 w/NNM_01201 or Windows 2003; custom exploits may use different gadgets. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'ovwebsnmpsrv.exe main' Remote Buffer Overflow (Metasploit)
exploitdb·2011-03-23·CVSS 10.0
CVE-2010-1964 [CRITICAL] HP OpenView Network Node Manager (OV NNM) - 'ovwebsnmpsrv.exe main' Remote Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'ovwebsnmpsrv.exe main' Remote Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_ovwebsnmpsrv_main.rb 12097 2011-03-23 15:45:48Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HEAD', :uri => '/OvCgi/jovgraph.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'HP OpenView Network Node Manager ovwebsnmpsrv.exe main Buffer Overflow',
'Description' => %q{
Thi
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'ovwebsnmpsrv.exe ovutil' Remote Buffer Overflow (Metasploit)
exploitdb·2011-03-23·CVSS 7.5
CVE-2010-1961 [HIGH] HP OpenView Network Node Manager (OV NNM) - 'ovwebsnmpsrv.exe ovutil' Remote Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'ovwebsnmpsrv.exe ovutil' Remote Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_ovwebsnmpsrv_ovutil.rb 12096 2011-03-23 15:44:55Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HEAD', :uri => '/OvCgi/jovgraph.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'HP OpenView Network Node Manager ovwebsnmpsrv.exe ovutil Buffer Overflow',
'Description' => %
Metasploit
HP OpenView Network Node Manager ovwebsnmpsrv.exe ovutil Buffer Overflow
metasploit·CVSS 7.5
[HIGH] HP OpenView Network Node Manager ovwebsnmpsrv.exe ovutil Buffer Overflow
HP OpenView Network Node Manager ovwebsnmpsrv.exe ovutil Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. This vulnerability is triggerable via either a GET or POST request. It is interesting to note that this vulnerability cannot be exploited by overwriting SEH, since attempting to would trigger CVE-2010-1964. The vulnerable code is within a sub-function called from "main" within "ovwebsnmpsrv.exe" with a timestamp prior to April 7th, 2010. This function contains a 256 byte stack buffer which is passed to the "getProxiedStorageAddress" function within ovu
Metasploit
HP OpenView Network Node Manager ovwebsnmpsrv.exe main Buffer Overflow
metasploit·CVSS 10.0
[CRITICAL] HP OpenView Network Node Manager ovwebsnmpsrv.exe main Buffer Overflow
HP OpenView Network Node Manager ovwebsnmpsrv.exe main Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. This vulnerability is triggerable via either a GET or POST request. The buffer being written to is 1024 bytes in size. It is important to note that this vulnerability must be exploited by overwriting SEH. Otherwise, CVE-2010-1961 is triggered! The vulnerable code is within the "main" function within "ovwebsnmpsrv.exe" with a timestamp prior to April 7th, 2010. There are no stack cookies, so exploitation is easily achieved by overwriting SEH structures. T
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=127602909915281&w=2http://secunia.com/advisories/40101http://www.securityfocus.com/archive/1/511731/100/0/threadedhttp://www.securityfocus.com/bid/40638http://www.securitytracker.com/id?1024071http://www.zerodayinitiative.com/advisories/ZDI-10-106/https://exchange.xforce.ibmcloud.com/vulnerabilities/59250http://marc.info/?l=bugtraq&m=127602909915281&w=2http://secunia.com/advisories/40101http://www.securityfocus.com/archive/1/511731/100/0/threadedhttp://www.securityfocus.com/bid/40638http://www.securitytracker.com/id?1024071http://www.zerodayinitiative.com/advisories/ZDI-10-106/https://exchange.xforce.ibmcloud.com/vulnerabilities/59250
2010-06-10
Published