BID:12077

HP-UX FTP Server Debug Logging Mode Buffer Overflow Vulnerability

Info

HP-UX FTP Server Debug Logging Mode Buffer Overflow Vulnerability

Bugtraq ID:	12077
Class:	Boundary Condition Error
CVE:	CVE-2004-1332
Remote:	Yes
Local:	No
Published:	Dec 22 2004 12:00AM
Updated:	Jul 12 2009 09:26AM
Credit:	Discovery credited to iDEFENSE Labs.
Vulnerable:	HP HP-UX (VVOS) 11.0 4 HP HP-UX (VVOS) 10.24 HP HP-UX 11.23 HP HP-UX 11.22 HP HP-UX 11.20 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX 10.24 HP HP-UX 10.20 SIS HP HP-UX 10.20 Series 800 HP HP-UX 10.20 Series 700 HP HP-UX 10.20 HP HP-UX 10.10 HP HP-UX 10.0 1 HP HP-UX B.11.22 HP HP-UX B.11.11 HP HP-UX B.11.04 HP HP-UX B.11.00

Not Vulnerable:

Discussion

HP-UX FTP Server Debug Logging Mode Buffer Overflow Vulnerability

It has been reported that the FTP server included with HP-UX is vulnerable to a remotely exploitable pre-authentication buffer overflow if configured to log debug output. This is not a default configuration. An administrator at some point would had to have configured inetd to invoke the ftpd server process with the "-v" parameter. Remote attackers can exploit this vulnerability to gain root privileges on the affected host.

Exploit / POC

HP-UX FTP Server Debug Logging Mode Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

HP-UX FTP Server Debug Logging Mode Buffer Overflow Vulnerability

Solution:
The original advisory from iDEFENSE listed patches for specific versions of HP-UX. On December 23, 2004, HP re-issued advisory HPSBUX0107-162 (originally published in 2001) stating that the fixes listed in the advisory correct this issue. However, the patch numbers listed in the advisory are different than what was included in the iDEFENSE report.

HP has released advisory HPSBUX01118 - SSRT4883 on February 8th, 2005 dealing with this issue. The patches provided in this advisory match those reported by iDEFENSE. Users are advised to update their products with these patches as soon as possible.

HP HP-UX B.11.11