CVE-2011-0267
published 2011-01-13CVE-2011-0267: Multiple buffer overflows in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allow remote attackers to execute arbitrary code via a…
PriorityP273critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
71.66%
99.4th percentile
Multiple buffer overflows in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allow remote attackers to execute arbitrary code via a long (1) schdParams or (2) nameParams parameter, a different vulnerability than CVE-2011-0266.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP POST requests to /OvCgi/nnmRptConfig.exe with abnormally large schdParams or nameParams parameter values (offset to SEH chain is 46919 bytes), indicative of a stack buffer overflow attempt. ↗
- →Flag HTTP POST requests to /OvCgi/nnmRptConfig.exe containing bad characters \x00, \x26 (+), \x2b (&) stripped from payload — their absence in an oversized parameter body is characteristic of this exploit. ↗
- →Detect use of SEH-based exploitation chain targeting OvWww.dll at RET address 0x5A30532D (POP/POP/RET gadget) on Windows Server 2003 targets running NNM 7.53. ↗
- →Look for HTTP POST requests to /OvCgi/nnmRptConfig.exe with Content-Type: application/x-www-form-urlencoded and a body length consistent with ~46919+ bytes, as the exploit pads to the SEH offset with NOPs. ↗
- ·The Metasploit module only includes a single target (NNM 7.53 on Windows Server 2003 Ent); the RET address and offsets are specific to that platform/version combination and will not apply to NNM 7.51 or other OS targets without adjustment. ↗
- ·The exploit uses ExitFunction SEH and AutoRunScript migrate -f, meaning post-exploitation process migration is automatic; detections based solely on the nnmRptConfig.exe process may miss follow-on activity in a migrated process. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2w6p-6qgj-jpgr: Multiple buffer overflows in nnmRptConfig
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2011-0267 [CRITICAL] CWE-119 GHSA-2w6p-6qgj-jpgr: Multiple buffer overflows in nnmRptConfig
Multiple buffer overflows in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allow remote attackers to execute arbitrary code via a long (1) schdParams or (2) nameParams parameter, a different vulnerability than CVE-2011-0266.
GHSA
GHSA-7rj2-8vxc-4g4c: Buffer overflow in nnmRptConfig
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2011-0266 [CRITICAL] CWE-119 GHSA-7rj2-8vxc-4g4c: Buffer overflow in nnmRptConfig
Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long nameParams parameter, a different vulnerability than CVE-2011-0267.2.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'nnmRptConfig.exe schdParams' Remote Buffer Overflow (Metasploit)
exploitdb·2011-03-24
CVE-2011-0267 HP OpenView Network Node Manager (OV NNM) - 'nnmRptConfig.exe schdParams' Remote Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'nnmRptConfig.exe schdParams' Remote Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_nnmrptconfig_schdparams.rb 12121 2011-03-24 00:49:33Z swtornio $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow",
'Description' => %q{
This module exploits NNM's nnmRptConfig.exe. Similar to other NNM CGI bugs,
the overflow occurs during a ov.sprintf_new() call, which allows an attacker to
overwrite data on the stack, and gain arbitrary code execution.
Metasploit
HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow
metasploit
HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow
HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow
This module exploits NNM's nnmRptConfig.exe. Similar to other NNM CGI bugs, the overflow occurs during a ov.sprintf_new() call, which allows an attacker to overwrite data on the stack, and gain arbitrary code execution.
No writeups or analysis indexed.
http://securityreason.com/securityalert/8156http://www.exploit-db.com/exploits/17038http://www.securityfocus.com/archive/1/515628http://www.securityfocus.com/bid/45762http://www.securitytracker.com/id?1024951http://www.vupen.com/english/advisories/2011/0085http://www.zerodayinitiative.com/advisories/ZDI-11-009/https://exchange.xforce.ibmcloud.com/vulnerabilities/64649http://securityreason.com/securityalert/8156http://www.exploit-db.com/exploits/17038http://www.securityfocus.com/archive/1/515628http://www.securityfocus.com/bid/45762http://www.securitytracker.com/id?1024951http://www.vupen.com/english/advisories/2011/0085http://www.zerodayinitiative.com/advisories/ZDI-11-009/https://exchange.xforce.ibmcloud.com/vulnerabilities/64649
2011-01-13
Published