CVE-2011-0266
published 2011-01-13CVE-2011-0266: Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long…
PriorityP273critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
70.11%
99.4th percentile
Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long nameParams parameter, a different vulnerability than CVE-2011-0267.2.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for HTTP POST requests targeting /OvCgi/nnmRptConfig.exe with an abnormally large nameParams parameter value (offset threshold: 46913 bytes). ↗
- →Alert on POST requests to /OvCgi/nnmRptConfig.exe containing the nameParams or schdParams parameters with payloads exceeding normal length bounds. ↗
- →Detect exploit payload bad characters pattern: null byte, ampersand, and plus sign are avoided (\x00\x26\x2b), so their absence in an otherwise large POST body to nnmRptConfig.exe is suspicious. ↗
- →Look for SEH-based exploitation patterns (ExitFunction=seh) combined with post-exploitation process migration activity on HP NNM hosts. ↗
- ·The exploit target is specifically Windows Server 2003 Enterprise; the hardcoded return address (0x5A30532D) and offset (46913) are version-specific and will not work against other OS versions without modification. ↗
- ·Affected versions are HP OV NNM 7.51 and 7.53 only; other versions are not confirmed vulnerable by the available sources. ↗
- ·The default exploit listener port is 80; deployments of HP NNM on non-standard ports would require adjustment of detection rules. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2w6p-6qgj-jpgr: Multiple buffer overflows in nnmRptConfig
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2011-0267 [CRITICAL] CWE-119 GHSA-2w6p-6qgj-jpgr: Multiple buffer overflows in nnmRptConfig
Multiple buffer overflows in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allow remote attackers to execute arbitrary code via a long (1) schdParams or (2) nameParams parameter, a different vulnerability than CVE-2011-0266.
GHSA
GHSA-7rj2-8vxc-4g4c: Buffer overflow in nnmRptConfig
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2011-0266 [CRITICAL] CWE-119 GHSA-7rj2-8vxc-4g4c: Buffer overflow in nnmRptConfig
Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long nameParams parameter, a different vulnerability than CVE-2011-0267.2.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - nnmRptConfig nameParams Buffer Overflow (Metasploit)
exploitdb·2011-03-23
CVE-2011-0266 HP OpenView Network Node Manager (OV NNM) - nnmRptConfig nameParams Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - nnmRptConfig nameParams Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_nnmrptconfig_nameparams.rb 12085 2011-03-23 03:37:18Z sinn3r $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "HP OpenView NNM nnmRptConfig nameParams Buffer Overflow",
'Description' => %q{
This module exploits a vulnerability in HP NNM's nnmRptConfig.exe.
A remote user can send a long string data to the nameParams parameter via
a POST request, which causes an overflow on the stack when function
ov.sprintf_new() is used, and
Metasploit
HP OpenView NNM nnmRptConfig nameParams Buffer Overflow
metasploit
HP OpenView NNM nnmRptConfig nameParams Buffer Overflow
HP OpenView NNM nnmRptConfig nameParams Buffer Overflow
This module exploits a vulnerability in HP NNM's nnmRptConfig.exe. A remote user can send a long string data to the nameParams parameter via a POST request, which causes an overflow on the stack when function ov.sprintf_new() is used, and gain arbitrary code execution.'
No writeups or analysis indexed.
http://securityreason.com/securityalert/8151http://www.securityfocus.com/archive/1/515628http://www.securityfocus.com/bid/45762http://www.securitytracker.com/id?1024951http://www.vupen.com/english/advisories/2011/0085http://www.zerodayinitiative.com/advisories/ZDI-11-008/https://exchange.xforce.ibmcloud.com/vulnerabilities/64650http://securityreason.com/securityalert/8151http://www.securityfocus.com/archive/1/515628http://www.securityfocus.com/bid/45762http://www.securitytracker.com/id?1024951http://www.vupen.com/english/advisories/2011/0085http://www.zerodayinitiative.com/advisories/ZDI-11-008/https://exchange.xforce.ibmcloud.com/vulnerabilities/64650
2011-01-13
Published