Advisory Details

May 10th, 2011

HP 3COM/H3C Intelligent Management Center img Remote Code Execution Vulnerability

ZDI-11-160
ZDI-CAN-1010

CVE ID CVE-2011-1848
CVSS SCORE 10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
AFFECTED VENDORS Hewlett-Packard
AFFECTED PRODUCTS H3C Intelligent Management Center
TREND MICRO CUSTOMER PROTECTION Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 10953. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP 3COM/H3C Intelligent Management Center. Authentication is not required to exploit this vulnerability.

The flaw exists within the img.exe component which listens by default on TCP port 8800. When handling a packet the process uses the packet length field to make a calculation and blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.

ADDITIONAL DETAILS Hewlett-Packard has issued an update to correct this vulnerability. More details can be found at:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02822750
DISCLOSURE TIMELINE
  • 2010-12-01 - Vulnerability reported to vendor
  • 2011-05-10 - Coordinated public release of advisory
CREDIT AbdulAziz Hariri
Luigi Auriemma
BACK TO ADVISORIES