Vulnerabilities > CVE-2011-0266 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in HP Openview Network Node Manager 7.51/7.53

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(51645);
  script_version("1.13");
  script_cvs_date("Date: 2018/11/15 20:50:18");

  script_cve_id("CVE-2010-2703", "CVE-2011-0261", "CVE-2011-0262", "CVE-2011-0263",
                "CVE-2011-0264", "CVE-2011-0265", "CVE-2011-0266", "CVE-2011-0267",
                "CVE-2011-0268", "CVE-2011-0269", "CVE-2011-0270", "CVE-2011-0271");
  script_bugtraq_id(41829,45762);
  script_xref(name:"EDB-ID", value:"17028");
  script_xref(name:"EDB-ID", value:"17038");

  script_name(english:"HP OpenView Network Node Manager Remote Execution of Arbitrary Code (HPSBMA02621 SSRT100352)");
  script_summary(english:"Tries to overflow execvp_nc() buffer in webappmon.exe");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server contains a CGI application that allows remote
code execution.");
  script_set_attribute(attribute:"description", value:
"The version of HP OpenView Network Node Manager installed on the remote
Windows host contains several vulnerabilities that can be exploited
remotely to allow execution of arbitrary code within the context of the
affected web server userid.");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-003/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-004/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-005/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-006/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-007/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-008/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-009/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-010/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-010/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-011/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-11-012/");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3ae2c3f5");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5e3effcb");
  script_set_attribute(attribute:"solution", value:"Apply patch NNM_01208 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/07/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/01/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"CGI abuses");
  script_copyright(english:"This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.");

  script_dependencies("http_version.nasl");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("global_settings.inc");
include("misc_func.inc");
include("http.inc");


port = get_http_port(default:80, embedded: 0);

url     = '/OvCgi/webappmon.exe';
params  = 'ins=nowait&sel=localhost&act=ping';

# make sure NNM is running
w = http_send_recv3(method:'GET', item:url + '?' + params, port:port,exit_on_fail:TRUE);
if (
  w[0] !~ '^HTTP/1.[01][ \t]+200' ||
  w[2] !~ '<title>ping</title>'   || 
  w[2] !~ 'webappmon.exe'
)  exit(0, "The web server on port "+port+" does not appear to be OpenView NNM for Windows.");

# now do buffer overflow
nodename = crap(data:'A',length:0x4000);
data = 'ins=nowait&sel=' + nodename + '&act=ping';
w = http_send_recv3(method:'POST', item:url,port:port,exit_on_fail:TRUE,
                    content_type:"application/x-www-form-urlencoded", data:data);

res = w[2];

if(isnull(res)) exit(0,"The response from OpenView NNM for Windows on port "+port+" does not have an HTTP response body.");


# buffer overflow causes webappmon.exe to die
if ('Error in CGI Application' >< res) security_hole(port);
# patched version uses strncat() to truncate user-controlled data
# what's sent will be reflected in return
# text after Ping is somewhat truncated, possibly because the 0x4000-byte buffer also holds
# standard output and error pipe names and other info
else if ('sel=' + nodename >< res && res =~ 'Ping : A{10000,}') exit(0, "The OpenView NNM for Windows install on port "+port+" is not affected.");
# unexpected return
else exit(0, "Unexpected response ("+res+") received from the OpenView NNM for Windows install on port "+port+".");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and patch checks in this plugin were 
# extracted from HP patch PHSS_41607. The text itself is
# copyright (C) Hewlett-Packard Development Company, L.P.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(56844);
  script_version("1.10");
  script_cvs_date("Date: 2018/07/12 19:01:15");

  script_cve_id("CVE-2010-2703", "CVE-2011-0261", "CVE-2011-0262", "CVE-2011-0263", "CVE-2011-0264", "CVE-2011-0265", "CVE-2011-0266", "CVE-2011-0267", "CVE-2011-0268", "CVE-2011-0269", "CVE-2011-0270", "CVE-2011-0271");
  script_bugtraq_id(41829);
  script_xref(name:"HP", value:"emr_na-c02286088");
  script_xref(name:"HP", value:"emr_na-c02670501");
  script_xref(name:"HP", value:"SSRT100025");
  script_xref(name:"HP", value:"SSRT100352");

  script_name(english:"HP-UX PHSS_41607 : s700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28");
  script_summary(english:"Checks for the patch in the swlist output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote HP-UX host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"s700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 28 : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - Potential security vulnerabilities have been identified
    with HP OpenView Network Node Manager (OV NNM). The
    vulnerabilities could be exploited remotely to execute
    arbitrary code under the context of the user running the
    web server. References: CVE-2011-0261 (ZDI-CAN-753)
    CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774)
    CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931)
    CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933)
    CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935)
    CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense).
    (HPSBMA02621 SSRT100352)

  - A potential vulnerability has been identified with HP
    OpenView Network Node Manager (OV NNM) running on
    Windows. The vulnerability could be exploited remotely
    to execute arbitrary code. References: CVE-2010-2703,
    ZDI-CAN-682. (HPSBMA02557 SSRT100025)"
  );
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?dae68cca"
  );
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02670501
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5e3effcb"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Install patch PHSS_41607 or subsequent."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hp:hp-ux");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/12/20");
  script_set_attribute(attribute:"patch_modification_date", value:"2011/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/06");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
  script_family(english:"HP-UX Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/HP-UX/version", "Host/HP-UX/swlist");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("hpux.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/HP-UX/version")) audit(AUDIT_OS_NOT, "HP-UX");
if (!get_kb_item("Host/HP-UX/swlist")) audit(AUDIT_PACKAGE_LIST_MISSING);

if (!hpux_check_ctx(ctx:"11.23 11.31", proc:"ia64"))
{
  exit(0, "The host is not affected since PHSS_41607 applies to a different OS release / architecture.");
}

patches = make_list("PHSS_41607", "PHSS_41858", "PHSS_42233", "PHSS_43047", "PHSS_43354");
foreach patch (patches)
{
  if (hpux_installed(app:patch))
  {
    exit(0, "The host is not affected because patch "+patch+" is installed.");
  }
}


flag = 0;
if (hpux_check_patch(app:"OVNNMgrRtDOC.OVNNM-KOR-DOC", version:"B.07.50.00")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:hpux_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and patch checks in this plugin were 
# extracted from HP patch PHSS_41606. The text itself is
# copyright (C) Hewlett-Packard Development Company, L.P.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(56843);
  script_version("1.10");
  script_cvs_date("Date: 2018/07/12 19:01:15");

  script_cve_id("CVE-2010-2703", "CVE-2011-0261", "CVE-2011-0262", "CVE-2011-0263", "CVE-2011-0264", "CVE-2011-0265", "CVE-2011-0266", "CVE-2011-0267", "CVE-2011-0268", "CVE-2011-0269", "CVE-2011-0270", "CVE-2011-0271");
  script_bugtraq_id(41829);
  script_xref(name:"HP", value:"emr_na-c02286088");
  script_xref(name:"HP", value:"emr_na-c02670501");
  script_xref(name:"HP", value:"SSRT100025");
  script_xref(name:"HP", value:"SSRT100352");

  script_name(english:"HP-UX PHSS_41606 : s700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28");
  script_summary(english:"Checks for the patch in the swlist output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote HP-UX host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"s700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 28 : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential vulnerability has been identified with HP
    OpenView Network Node Manager (OV NNM) running on
    Windows. The vulnerability could be exploited remotely
    to execute arbitrary code. References: CVE-2010-2703,
    ZDI-CAN-682. (HPSBMA02557 SSRT100025)

  - Potential security vulnerabilities have been identified
    with HP OpenView Network Node Manager (OV NNM). The
    vulnerabilities could be exploited remotely to execute
    arbitrary code under the context of the user running the
    web server. References: CVE-2011-0261 (ZDI-CAN-753)
    CVE-2011-0262 (ZDI-CAN-757) CVE-2011-0263 (ZDI-CAN-774)
    CVE-2011-0264 (ZDI-CAN-810) CVE-2011-0265 (ZDI-CAN-931)
    CVE-2011-0266 (ZDI-CAN-932) CVE-2011-0267 (ZDI-CAN-933)
    CVE-2011-0268 (ZDI-CAN-934) CVE-2011-0269 (ZDI-CAN-935)
    CVE-2011-0270 (ZDI-CAN-936) CVE-2011-0271 (iDefense).
    (HPSBMA02621 SSRT100352)"
  );
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?dae68cca"
  );
  # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02670501
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5e3effcb"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Install patch PHSS_41606 or subsequent."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hp:hp-ux");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/12/20");
  script_set_attribute(attribute:"patch_modification_date", value:"2011/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/06");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
  script_family(english:"HP-UX Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/HP-UX/version", "Host/HP-UX/swlist");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("hpux.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/HP-UX/version")) audit(AUDIT_OS_NOT, "HP-UX");
if (!get_kb_item("Host/HP-UX/swlist")) audit(AUDIT_PACKAGE_LIST_MISSING);

if (!hpux_check_ctx(ctx:"11.11 11.23 11.31", proc:"parisc"))
{
  exit(0, "The host is not affected since PHSS_41606 applies to a different OS release / architecture.");
}

patches = make_list("PHSS_41606", "PHSS_41857", "PHSS_42232", "PHSS_43046", "PHSS_43353");
foreach patch (patches)
{
  if (hpux_installed(app:patch))
  {
    exit(0, "The host is not affected because patch "+patch+" is installed.");
  }
}


flag = 0;
if (hpux_check_patch(app:"OVNNMgrRtDOC.OVNNM-KOR-DOC", version:"B.07.50.00")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:hpux_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");