(0day) HP 3COM/H3C Intelligent Management Center img recv Remote Code Execution Vulnerability

2011-05-31T00:00:00
ID ZDI-11-170
Type zdi
Reporter Luigi Auriemma
Modified 2011-11-09T00:00:00

Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP 3COM/H3C Intelligent Management Center. Authentication is not required to exploit this vulnerability.

The flaw exists within the img.exe component which listens by default on TCP port 8800. When handling the a packet type the process uses a user provided length value in an arithmetic operation resulting in integer wrapping. The process then copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.