CVE-2011-1853
HP 3COM/H3C Intelligent Management Center tftpserver opcode_table Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a (1) large or (2) invalid opcode field, related to a function pointer table.
tftpserver.exe en HP Intelligent Management Center (IMC) v5.0 antes de E0101L02 permite a atacantes remotos ejecutar código de su elección a través de un campo (1) grande o (2) de opcode no válido, relacionado con una tabla de puntero de función.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP 3com/H3C Intelligent Management Center. Authentication is not required to exploit this vulnerability.
The flaw exists within the tftpserver.exe component which listens by default on UDP port 69. When handling the opcode word of a packet the process uses this value as a lookup into a function pointer table. The process then calls into the calculated address. By supplying a large or invalid value a remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2011-05-03 CVE Reserved
- 2011-05-10 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://securitytracker.com/id?1025519 | Vdb Entry | |
| http://www.securityfocus.com/bid/47789 | Vdb Entry | |
| http://www.zerodayinitiative.com/advisories/ZDI-11-165 | X_refsource_misc |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02822750 | 2019-10-09 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hp Search vendor "Hp" | Intelligent Management Center Search vendor "Hp" for product "Intelligent Management Center" | 5.0 Search vendor "Hp" for product "Intelligent Management Center" and version "5.0" | - |
Affected
| ||||||
| Hp Search vendor "Hp" | Intelligent Management Center Search vendor "Hp" for product "Intelligent Management Center" | 5.0 Search vendor "Hp" for product "Intelligent Management Center" and version "5.0" | e0101 |
Affected
| ||||||
| Hp Search vendor "Hp" | Intelligent Management Center Search vendor "Hp" for product "Intelligent Management Center" | 5.0 Search vendor "Hp" for product "Intelligent Management Center" and version "5.0" | e0101l01 |
Affected
| ||||||