HP-UX 'useradd' Local Unauthorized Access Vulnerability

Bugtraq ID:	34748
Class:	Access Validation Error
CVE:	CVE-2009-0719
Remote:	No
Local:	Yes
Published:	Apr 28 2009 12:00AM
Updated:	May 15 2009 03:26PM
Credit:	The vendor disclosed this issue.
Vulnerable:	HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.11 Avaya Proactive Contact 3.0
Not Vulnerable:

HP-UX 'useradd' Local Unauthorized Access Vulnerability

HP-UX is prone to a local unauthorized-access vulnerability because the software fails to properly restrict access to certain directories and files.

This issue affects the following versions:

HP-UX B.11.11
HP-UX B.11.23
HP-UX B.11.31

HP-UX 'useradd' Local Unauthorized Access Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP-UX 'useradd' Local Unauthorized Access Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for more information.


HP HP-UX B.11.23

• HP PHCO_38491
  http://itrc.hp.com

HP HP-UX B.11.11

• HP PHCO_38492
  http://itrc.hp.com

HP-UX 'useradd' Local Unauthorized Access Vulnerability

References:

• HP-UX Homepage (HP)
  
• [security bulletin] HPSBUX02366 SSRT080120 rev.1 - HPUX Running useradd(1M), Loc ([email protected])
  
• ASA-2009-178 - HPUX Running useradd(1M), Local Unauthorized Access (HPSBUX02366) (Avaya)