HP-UX LPD Arbitrary Command Execution Vulnerability

Bugtraq ID:	15136
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 19 2005 12:00AM
Updated:	Oct 19 2005 12:00AM
Credit:	This issue was reported by H D Moore <[email protected]>.
Vulnerable:	HP HP-UX 10.20 HP HP-UX B.11.11 HP HP-UX B.11.00
Not Vulnerable:

HP-UX LPD Arbitrary Command Execution Vulnerability

HP-UX lpd is affected by a remote arbitrary command execution vulnerability.

A successful attack can facilitate a complete compromise.

Reportedly, this issue was silently addressed by HP in HP security bulletin HPSBUX0208-213.

HP-UX LPD Arbitrary Command Execution Vulnerability

An exploit is not required.

A proof of concept (hpux_lpd_exec.pm) as part of Metasploit Framework has been released.

• /data/vulnerabilities/exploits/hpux_lpd_exec.pm

HP-UX LPD Arbitrary Command Execution Vulnerability

Solution:
Reports indicate that HP has addressed this issue in HP advisory HPSBUX0208-213. Symantec was not able to confirm this information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HP-UX LPD Arbitrary Command Execution Vulnerability

References:

• HP-UX LPD Command Execution (Metasploit)