PT-2010-4225 · Hewlett Packard+1 · Hp Openview Network Node Manager+1

Published 2010-07-21 · Updated 2018-10-10 · CVE-2010-2703

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP OpenView Network Node Manager versions 7.51 through 7.53

Description The issue is related to a stack-based buffer overflow in the execvp nc function within the ov.dll module of HP OpenView Network Node Manager, specifically when running on Windows. This allows remote attackers to execute arbitrary code by sending a long HTTP request to the webappmon.exe application.

Recommendations For HP OpenView Network Node Manager versions 7.51 through 7.53, consider restricting access to the webappmon.exe application until a patch is available. As a temporary workaround, limiting the length of HTTP requests to webappmon.exe may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-2703

ZDI-10-137

Affected Products

Hp Openview Network Node Manager

Windows

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb · Exploit
• 🔥 http://exploit-db.com/exploits/14916 · Exploit
• 🔥 https://exploit-db.com/exploits/14916 · Exploit
• 🔥 https://exploit-db.com/exploits/17030 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2703 · Security Note
• http://marc.info/?l=bugtraq&m=127973001009749&w=2 · Vendor Advisory
• http://secunia.com/advisories/40686 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-10-137 · Security Note
• http://vupen.com/english/advisories/2010/1866 · Vendor Advisory
• http://securitytracker.com/id?1024238 · Note
• http://osvdb.org/66514 · Note
• http://securitytracker.com/id?1024224 · Note
• http://securityreason.com/securityalert/8161 · Note
• http://attrition.org/pipermail/vim/2010-July/002374.html · Note
• http://securityfocus.com/archive/1/512552/100/0/threaded · Note