CVE-2011-3167
published 2011-11-02CVE-2011-3167: Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka…
PriorityP275critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
64.97%
99.3th percentile
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1210.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | openview_network_node_manager | — | — |
| hp | openview_network_node_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP POST requests to /OvCgi/webappmon.exe with an oversized 'textFile' parameter (offset 1067 bytes minus install path length) indicating a buffer overflow attempt. ↗
- →Detect directory traversal attempts against /OvCgi/OpenView5.exe with Action parameter containing '../../../log/setup.log' — used by the exploit to leak the installation path prior to the overflow. ↗
- →Look for HTTP requests to /OvCgi/OpenView5.exe with query parameters 'Context=Snmp' and 'Action' containing path traversal sequences as a precursor reconnaissance step. ↗
- →The exploit uses an egghunter shellcode encoded with x86/alpha_mixed with BufferRegister=ESP; detect alpha-numeric shellcode patterns in POST body to webappmon.exe. ↗
- →The exploit targets ov.dll version 1.30.5.8002; presence of this DLL version on a system without patch NNM_01213 or hotfix SSRT100649 indicates a vulnerable host. ↗
- →Monitor for webappmon.exe spawning unexpected child processes (e.g., notepad.exe, wordpad.exe) as a post-exploitation migration indicator. ↗
- ·The exploit only targets HP OV NNM 7.53 with specific patches (ECS_00048, NNM_01128, NNM_01172, NNM_01187) installed but WITHOUT patch NNM_01213 or hotfix SSRT100649; different patch levels will have different offsets and ROP gadget addresses. ↗
- ·The hardcoded ROP gadgets (Ret=0x5a41656a, JmpESP=0x5a4251c5) are specific to ov.dll v1.30.5.8002; these addresses will differ on other DLL versions. ↗
- ·If the directory traversal via OpenView5.exe (OSVDB 44359) fails to retrieve the installation path, the exploit falls back to the default path 'C:\Program Files\HP OpenView\', which may cause exploitation failure on non-default installs. ↗
- ·Post-exploitation migration to %windir%\system32\notepad.exe fails on Windows XP SP3 due to access denied; the module handles this by migrating to %ProgramFiles%\Windows NT\Accessories\wordpad.exe on XP instead. ↗
- ·Bad characters for the payload exclude bytes 0x00–0x09, 0x0b–0x23, and specific characters (0x26, 0x2b, 0x3c, 0x3e, 0x5b, 0x5d, 0x5e, 0x60, 0x7e, 0x7f), constraining usable shellcode. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager - 'ov.dll' _OVBuildPath Buffer Overflow (Metasploit)
exploitdb·2012-01-20
CVE-2011-3167 HP OpenView Network Node Manager - 'ov.dll' _OVBuildPath Buffer Overflow (Metasploit)
HP OpenView Network Node Manager - 'ov.dll' _OVBuildPath Buffer Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HEAD', :uri => '/OvCgi/webappmon.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::Egghunter
def initialize(info={})
super(update_info(info,
'Name' => 'HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP OpenView Network Node
Manager 7.53 p
Metasploit
HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow
metasploit
HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow
HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01213 without the SSRT100649 hotfix. By specifying a long 'textFile' argument when calling the 'webappmon.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code is within the "_OVBuildPath" function within "ov.dll". There are no stack cookies, so exploitation is achieved by overwriting the saved return address. The vulnerability is due to the use of the function "_OVConcatPath" which finally uses "strcat" in an insecure way. User controlled data is concatenated to a string which contains the OpenView installation path. To achieve reliable exploitation a director
No writeups or analysis indexed.
2011-11-02
Published