CVE-2014-2624
published 2014-09-11CVE-2014-2624: Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors, aka…
PriorityP277critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
65.44%
99.3th percentile
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2264.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | network_node_manager_i | — | — |
| hp | network_node_manager_i | — | — |
| hp | network_node_manager_i | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
pmdmgr_init check packet: \x05\x02\x00\x00\xcc\x03\x00\x00\x0c\x0a\x00\x00\xa8\x0c\x00\x00 (0x2a5, 0x3cc, 0xa0c, 0xca8 little-endian)
- →Detect the info-leak phase: a UDP packet to port 7426 with 4-byte header 0x000002aa followed by ~4000 null bytes, used to leak a libov pointer from the stack to defeat ASLR. ↗
- →Detect the exploit trigger: a UDP packet to port 7426 with header 0x000002a9 containing the string '-SA;' followed by a large ROP payload (~775 bytes of alpha text) and embedded command payload, targeting the pmd service strcpy/strcat stack overflow. ↗
- →Alert on the pmdmgr_init probe packet: UDP to port 7426 with exactly 0xfa4 (4004) bytes and leading bytes 05 02 00 00 CC 03 00 00 0C 0A 00 00 A8 0C 00 00; a valid 8-byte response with first DWORD 0x2a5 confirms a vulnerable pmd service. ↗
- →The exploit payload type is cmd/bash-compatible (generic python perl openssl bash-tcp gawk); look for unexpected shell process spawning from the pmd service process on affected HP NNMi Linux hosts. ↗
- ·The module notes 'Privileged => false' for NNMi 9.20 but 'true for HP NNMi 9.10', meaning post-exploitation privilege level differs between target versions. ↗
- ·Null bytes are bad characters for the payload; any detection or blocking of null bytes in UDP payloads to port 7426 will break the exploit but may also affect legitimate NNMi traffic. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP Network Node Manager I - PMD Buffer Overflow (Metasploit)
exploitdb·2014-10-02
CVE-2014-2624 HP Network Node Manager I - PMD Buffer Overflow (Metasploit)
HP Network Node Manager I - PMD Buffer Overflow (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'HP Network Node Manager I PMD Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP Network Node Manager I (NNMi). The
vulnerability exists in the pmd service, due to the insecure usage of functions like
strcpy and strcat while handling stack_option packets with user controlled data. In
order to bypass ASLR this module uses a proto_tbl packet to leak an libov pointer from
the stack and finally build the rop chain to avoid NX.
},
'Author' =>
[
'd(-_-)b', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
Metasploit
HP Network Node Manager I PMD Buffer Overflow
metasploit
HP Network Node Manager I PMD Buffer Overflow
HP Network Node Manager I PMD Buffer Overflow
This module exploits a stack buffer overflow in HP Network Node Manager I (NNMi). The vulnerability exists in the pmd service, due to the insecure usage of functions like strcpy and strcat while handling stack_option packets with user controlled data. In order to bypass ASLR this module uses a proto_tbl packet to leak an libov pointer from the stack and finally build the ROP chain to avoid NX.
No writeups or analysis indexed.
http://www.securitytracker.com/id/1030827https://exchange.xforce.ibmcloud.com/vulnerabilities/95875https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04378450http://www.securitytracker.com/id/1030827https://exchange.xforce.ibmcloud.com/vulnerabilities/95875https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04378450
2014-09-11
Published