Hewlet Packard HP-UX Portable File System Buffer Overflow Vulnerability
BID:23401
Info
Hewlet Packard HP-UX Portable File System Buffer Overflow Vulnerability
| Bugtraq ID: | 23401 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 10 2007 12:00AM |
| Updated: | Apr 12 2007 11:31PM |
| Credit: | iDefense Labs is credited with discovering this issue. |
| Vulnerable: |
HP HP-UX B.11.23 HP HP-UX B.11.11 HP HP-UX B.11.00 |
| Not Vulnerable: | |
Discussion
Hewlet Packard HP-UX Portable File System Buffer Overflow Vulnerability
HP-UX running PFS (Portable File System) is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.
An attacker may exploit this issue by submitting two maliciously crafted packets to a vulnerable computer.
The attacker may exploit this issue to execute arbitrary code on an affected computer with superuser privileges. Successful exploits will result in a complete compromise of affected computers. Failed exploit attempts will likely result in denial-of-service conditions.
NOTE: This vulnerability was initially reported as a privilege-escalation issue. Newly available information shows that this issue is a buffer-overflow vulnerability. This BID has been updated to reflect the changes.
HP-UX running PFS (Portable File System) is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.
An attacker may exploit this issue by submitting two maliciously crafted packets to a vulnerable computer.
The attacker may exploit this issue to execute arbitrary code on an affected computer with superuser privileges. Successful exploits will result in a complete compromise of affected computers. Failed exploit attempts will likely result in denial-of-service conditions.
NOTE: This vulnerability was initially reported as a privilege-escalation issue. Newly available information shows that this issue is a buffer-overflow vulnerability. This BID has been updated to reflect the changes.
Exploit / POC
Hewlet Packard HP-UX Portable File System Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution / Fix
Hewlet Packard HP-UX Portable File System Buffer Overflow Vulnerability
Solution:
The vendor has released fixes to address this issue. Please see the referenced advisory for details.
Solution:
The vendor has released fixes to address this issue. Please see the referenced advisory for details.
References
Hewlet Packard HP-UX Portable File System Buffer Overflow Vulnerability
References:
References: