CVE-2010-2703
published 2010-07-28CVE-2010-2703: Stack-based buffer overflow in the execvp_nc function in the ov.dll module in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when running on Windows…
PriorityP278critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
71.38%
99.4th percentile
Stack-based buffer overflow in the execvp_nc function in the ov.dll module in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when running on Windows, allows remote attackers to execute arbitrary code via a long HTTP request to webappmon.exe.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect large HTTP POST requests to /OvCgi/webappmon.exe — the exploit requires POST due to GET request size limitations, and sends a payload of ~250,000 bytes. ↗
- →Alert on POST requests to /OvCgi/webappmon.exe with oversized 'sel', 'app', 'arg', or 'help' POST body parameters exceeding the 16384-byte buffer boundary. ↗
- →The exploit uses alphanumeric mixed encoding with ECX as the buffer register; look for alphanumeric shellcode patterns in POST body to /OvCgi/webappmon.exe. ↗
- →The exploit uses SEH-based exploitation (ExitFunction=seh); monitor for SEH chain overwrites in NNM processes (webappmon.exe, ov.dll). ↗
- →Post-exploitation auto-migration is configured; monitor for unexpected process migration activity following webappmon.exe execution. ↗
- →The target buffer is 16384 bytes; two adjacent buffers are overflowed via strcat. Flag POST Content-Length values significantly exceeding 16384 to /OvCgi/webappmon.exe. ↗
- ·The vulnerability only affects HP OV NNM running on Windows; Linux/Unix deployments are not affected. ↗
- ·The Metasploit module return address (0x5A30532D) is specific to Windows Server 2003 Enterprise; exploitation against other OS versions requires a different RET address. ↗
- ·There are no stack cookies in the vulnerable code, making exploitation straightforward via saved return address or SEH frame overwrite. ↗
- ·The vulnerability may also be triggerable via other CGI programs in the OvCgi directory, but this was not fully investigated. ↗
- ·Bad characters for payload encoding exclude bytes 0x00–0x1f and 0x7f; detection signatures based on null bytes or control characters in the POST body will miss this exploit. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP Network Node Manager (NMM) - CGI 'webappmon.exe execvp' Remote Buffer Overflow (Metasploit)
exploitdb·2011-03-23
CVE-2010-2703 HP Network Node Manager (NMM) - CGI 'webappmon.exe execvp' Remote Buffer Overflow (Metasploit)
HP Network Node Manager (NMM) - CGI 'webappmon.exe execvp' Remote Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_webappmon_execvp.rb 12086 2011-03-23 03:38:46Z sinn3r $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "HP NNM CGI webappmon.exe execvp Buffer Overflow",
'Description' => %q{
This module exploits a buffer overflow in HP NNM's webappmon.exe.
The vulnerability occurs when function "execvp_nc" fails to do any bounds-
checking before strcat is used to append user-supplied input to a buffer.
},
'License' => MSF_LICENSE,
'Version' =
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'webappmon.exe execvp_nc' Remote Code Execution
exploitdb·2010-09-06·CVSS 10.0
CVE-2010-2703 [CRITICAL] HP OpenView Network Node Manager (OV NNM) - 'webappmon.exe execvp_nc' Remote Code Execution
HP OpenView Network Node Manager (OV NNM) - 'webappmon.exe execvp_nc' Remote Code Execution
---
'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
'''
'''
Title : HP OpenView NNM webappmon.exe execvp_nc Remote Code Execution
Version : OpenView Network Node Manager 7.53
Analysis : http://www.abysssec.com
Vendor : http://www.hp.com
Impact : Critical
Contact : shahin [at] abysssec.com , info [at] abysssec.com
Twitter : @abysssec
CVE : CVE-2010-2703
http://www.exploit-db.com/moaub-6-hp-openview-nnm-webappmon-exe-execvp_nc-remote-code-execution/
'''
import socket,sys
ip = "localhost"
port = 80
target = (ip, port)
s = socket.socket(socket.AF_INET, socket.SOC
Exploit-DB
Novell Groupwise Messenger Client - Remote Buffer Overflow (Metasploit)
exploitdb·2010-06-22
CVE-2008-2703 Novell Groupwise Messenger Client - Remote Buffer Overflow (Metasploit)
Novell Groupwise Messenger Client - Remote Buffer Overflow (Metasploit)
---
##
# $Id: groupwisemessenger_client.rb 9583 2010-06-22 19:11:05Z todb $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
class Metasploit3 'Novell GroupWise Messenger Client Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Novell's GroupWise Messenger Client.
By sending a specially crafted HTTP response, an attacker may be able to execute
arbitrary code.
},
'Author' => 'MC',
'License' => MSF_LICENSE,
'Version' => '$Revision: 9583 $',
'References' =>
[
[ 'CVE', '2008-2
Metasploit
HP OpenView Network Node Manager execvp_nc Buffer Overflow
metasploit
HP OpenView Network Node Manager execvp_nc Buffer Overflow
HP OpenView Network Node Manager execvp_nc Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01207 or NNM_01206 without the SSRT100025 hotfix. By specifying a long 'sel' parameter when calling methods within the 'webappmon.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. This vulnerability is not triggerable via a GET request due to limitations on the request size. The buffer being targeted is 16384 bytes in size. There are actually two adjacent buffers that both get overflowed (one into the other), and strcat is used. The vulnerable code is within the "execvp_nc" function within "ov.dll" prior to v 1.30.12.69. There are no stack cookies, so exploitation is easily achieved by
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=127973001009749&w=2http://osvdb.org/66514http://secunia.com/advisories/40686http://securityreason.com/securityalert/8161http://www.attrition.org/pipermail/vim/2010-July/002374.htmlhttp://www.exploit-db.com/exploits/14916http://www.securityfocus.com/archive/1/512544/100/0/threadedhttp://www.securityfocus.com/archive/1/512552/100/0/threadedhttp://www.securityfocus.com/bid/41829http://www.securitytracker.com/id?1024224http://www.securitytracker.com/id?1024238http://www.vupen.com/english/advisories/2010/1866http://marc.info/?l=bugtraq&m=127973001009749&w=2http://osvdb.org/66514http://secunia.com/advisories/40686http://securityreason.com/securityalert/8161http://www.attrition.org/pipermail/vim/2010-July/002374.htmlhttp://www.exploit-db.com/exploits/14916http://www.securityfocus.com/archive/1/512544/100/0/threadedhttp://www.securityfocus.com/archive/1/512552/100/0/threadedhttp://www.securityfocus.com/bid/41829http://www.securitytracker.com/id?1024224http://www.securitytracker.com/id?1024238http://www.vupen.com/english/advisories/2010/1866
2010-07-28
Published