CVE-2010-2709
published 2010-08-05CVE-2010-2709: Stack-based buffer overflow in webappmon.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a…
PriorityP270critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
42.26%
98.5th percentile
Stack-based buffer overflow in webappmon.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long OvJavaLocale value in a cookie.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP GET requests to /OvCgi/webappmon.exe containing a Cookie header with an OvJavaLocale value exceeding 5120 bytes, which triggers the stack buffer overflow in OvWwwDebug(). ↗
- →Alert on Cookie headers containing 'OvJavaLocale=' with an abnormally long value (e.g., thousands of repeated characters) followed by '.Cp1252' in requests to webappmon.exe. ↗
- →The exploit uses alphanumeric mixed encoding with ECX as the buffer register; look for alphanumeric shellcode in the OvJavaLocale cookie value. ↗
- →The exploit overwrites the SEH frame (ExitFunction=seh); monitor for SEH-based exploitation patterns in webappmon.exe process crashes or structured exception handler overwrites. ↗
- →Multiple CGI applications beyond webappmon.exe and multiple cookie values beyond OvJavaLocale may trigger the same overflow; monitor all /OvCgi/ endpoints for oversized cookie headers. ↗
- ·The Metasploit module targets Windows Server 2003 Enterprise specifically with a hardcoded return address (0x5A30532D); the exploit may not work reliably on other OS/patch combinations. ↗
- ·There are no stack cookies in the vulnerable binary, making exploitation straightforward via saved return address or SEH frame overwrite. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP Network Node Manager (NMM) - CGI 'webappmon.exe OvJavaLocale' Remote Buffer Overflow (Metasploit)
exploitdb·2011-03-23
CVE-2010-2709 HP Network Node Manager (NMM) - CGI 'webappmon.exe OvJavaLocale' Remote Buffer Overflow (Metasploit)
HP Network Node Manager (NMM) - CGI 'webappmon.exe OvJavaLocale' Remote Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_webappmon_ovjavalocale.rb 12087 2011-03-23 03:39:12Z sinn3r $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow",
'Description' => %q{
This module exploits a stack-based overflow in HP NNM's webappmon.exe.
The vulnerability occurs when a long string of data is sent as OvJavaLocale's
cookie value, OvWww.dll fails to properly do any bounds checking before this
input is pa
Exploit-DB
HP OpenView Network Node Manager (OV NNM) 7.53 - 'OvJavaLocale' Buffer Overflow
exploitdb·2010-08-03·CVSS 9.3
CVE-2010-2709 [CRITICAL] HP OpenView Network Node Manager (OV NNM) 7.53 - 'OvJavaLocale' Buffer Overflow
HP OpenView Network Node Manager (OV NNM) 7.53 - 'OvJavaLocale' Buffer Overflow
---
HP OPENVIEW NNM OVJAVALOCALE BUFFER OVERFLOW VULNERABILITY
1. ADVISORY INFORMATION
Title: HP OpenView NNM OvJavaLocale Buffer Overflow Vulnerability
Advisory Id: CORE-2010-0608
Advisory URL: http://www.coresecurity.com/content/hp-nnm-ovjavalocale-buffer-overflow
Date published: 2010-08-03
Date of last update: 2010-08-03
Vendors contacted: HP
Release mode: Coordinated release
2. VULNERABILITY INFORMATION
Class: Buffer overflow [CWE-119]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2010-2709
Bugtraq ID: N/A
3. VULNERABILITY DESCRIPTION
There is a buffer overflow vulnerability in the webappmon.exe CGI application included with HP OpenView NNM[1]. This bug can be
Metasploit
HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow
metasploit
HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow
HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a request containing a cookie longer than 5120 bytes, an attacker can overflow a stack buffer and execute arbitrary code. The vulnerable code is within the OvWwwDebug function. The static-sized stack buffer is declared within this function. When the vulnerability is triggered, the stack trace looks like the following: #0 ... #1 sprintf_new(local_stack_buf, fmt, cookie); #2 OvWwwDebug(" HTTP_COOKIE=%s\n", cookie); #3 ?OvWwwInit@@YAXAAHQAPADPBD@Z(x, x, x); #4 sub_405ee0("nnm", "webappmon"); No validation is done on the cookie argument. There are no stack cookies, so exploitation is easily achieved by overwriting the saved return address or S
No writeups or analysis indexed.
http://seclists.org/bugtraq/2010/Aug/21http://securityreason.com/securityalert/8150http://securitytracker.com/id?1024274http://www.coresecurity.com/content/hp-nnm-ovjavalocale-buffer-overflowhttp://www.exploit-db.com/exploits/14547http://www.securityfocus.com/bid/42154https://exchange.xforce.ibmcloud.com/vulnerabilities/60880http://seclists.org/bugtraq/2010/Aug/21http://securityreason.com/securityalert/8150http://securitytracker.com/id?1024274http://www.coresecurity.com/content/hp-nnm-ovjavalocale-buffer-overflowhttp://www.exploit-db.com/exploits/14547http://www.securityfocus.com/bid/42154https://exchange.xforce.ibmcloud.com/vulnerabilities/60880
2010-08-05
Published