CVE-2012-3282

published 2013-02-06

CVE-2012-3282: Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via…

Priority P2 69 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1468.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
hp	san_iq	<= 9.5	—
hp	san_iq	—	—
hp	san_iq	—	—
hp	san_iq	—	—
hp	san_iq	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 13838↗

command login:/global$agent/L0CAlu53R/Version "9.0.0"↗

other RET gadget 0x0804EB34 (pop ebp; ret) from hydra binary↗

other FakeObject pointer 0x08072E58 from hydra data segment↗

other JmpEsp gadget 0x08050CB8 (push esp; ret) from hydra binary↗

hash e6af8de8b1d4b2b6d5ba2610cbf9cd38↗

bytes↗

\x00\x00\x00\x00\x00\x00\x00\x01 [4-byte length] \x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x14\xff\xff\xff\xff

• → Detect exploit attempts by monitoring TCP connections to port 13838 containing the login command string with oversized credentials (offset 3446 bytes) followed by structured binary header starting with \x00\x00\x00\x00\x00\x00\x00\x01 ↗
• → Alert on login packets to port 13838 where the packet header contains the fixed magic bytes \x00\x00\x00\x14\xff\xff\xff\xff preceding the login payload ↗
• → Detect version-check probes using the hardcoded credential string 'L0CAlu53R' in login requests to the HP VSA hydra service on port 13838 ↗
• → Flag login packets to port 13838 where the login field exceeds 3446 bytes, indicating a buffer overflow attempt against sscanf() in the hydra login parser ↗
• → Detect stack-adjustment shellcode prepended with \x81\xc4\x54\xf2\xff\xff (add esp, -3500) in payloads delivered to port 13838 ↗

• · The ROP gadget addresses (Ret, FakeObject, JmpEsp) are hardcoded for HP VSA version 9 only and will not apply to other versions of the hydra binary ↗
• · Bad characters \x2f, \x00, \x0d, \x0a are filtered by the exploit encoder; payloads containing these bytes in shellcode will be encoded and may evade naive signature matching on raw bytes ↗
• · The exploit module references CVE-2013-2343 and ZDI-13-179, not CVE-2012-3282; the NVD entry for CVE-2012-3282 references ZDI-CAN-1468 — these may be distinct but related vulnerabilities in the same hydra component ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.