CVE-2011-1866
published 2011-07-01CVE-2011-1866: Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitrary code…
PriorityP269critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
20.89%
97.6th percentile
Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitrary code via a crafted request, related to the EXEC_CMD functionality.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_storage_data_protector | — | — |
| hp | openview_storage_data_protector | — | — |
| hp | openview_storage_data_protector | — | — |
| hp | openview_storage_data_protector | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect oversized path field (>= 5000 bytes) in requests to TCP port 5555 targeting the HP Data Protector inet service (omniinet.exe); the PoC sends a 5000-byte 'A'-padded path field. ↗
- →The exploit packet begins with a specific header structure: two little-endian 0x0020 WORDs, four big-endian 0x0020 WORDs, one little-endian 0x0020 WORD, followed by the oversized path, then a big-endian 0x0000 WORD terminator. Monitor for this packet pattern on TCP/5555. ↗
- →The total packet length is sent as a big-endian 4-byte prefix before the packet body. Anomalously large length values (e.g., corresponding to ~5000+ byte paths) on TCP/5555 to omniinet.exe should be flagged. ↗
- →SEH handler overwrite with value 0x00410041 (Unicode 'AA') in omniinet.exe is a crash indicator of successful exploitation of this buffer overflow. ↗
- ·Vulnerability affects HP OpenView Storage Data Protector v6.00 through v6.20 running on Windows only; non-Windows platforms were not tested. ↗
- ·Mitigation (not a full fix at time of publication) requires enabling encrypted control communication services on the cell server and all clients in the cell, in addition to upgrading to A.06.20 or subsequent. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182http://secunia.com/advisories/45100http://securityreason.com/securityalert/8289http://securitytracker.com/id?1025731http://www.coresecurity.com/content/HP-Data-Protector-EXECCMD-Vulnerabilityhttp://www.exploit-db.com/exploits/17461http://www.securityfocus.com/archive/1/518666/100/0/threadedhttp://www.securityfocus.com/bid/48488https://exchange.xforce.ibmcloud.com/vulnerabilities/68297http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182http://secunia.com/advisories/45100http://securityreason.com/securityalert/8289http://securitytracker.com/id?1025731http://www.coresecurity.com/content/HP-Data-Protector-EXECCMD-Vulnerabilityhttp://www.exploit-db.com/exploits/17461http://www.securityfocus.com/archive/1/518666/100/0/threadedhttp://www.securityfocus.com/bid/48488https://exchange.xforce.ibmcloud.com/vulnerabilities/68297
2011-07-01
Published