HP-UX RBAC Unspecified Local Unauthorized Access Vulnerability

Bugtraq ID:	36476
Class:	Access Validation Error
CVE:	CVE-2009-2682
Remote:	No
Local:	Yes
Published:	Sep 22 2009 12:00AM
Updated:	Sep 22 2009 07:50PM
Credit:	Logica UK Limited
Vulnerable:	HP HP-UX B.11.31 HP HP-UX B.11.23
Not Vulnerable:

HP-UX RBAC Unspecified Local Unauthorized Access Vulnerability

HP-UX is prone to a local unspecified unauthorized-access vulnerability.

This issue affects the following versions running Role-Based Access Control (RBAC):

HP-UX B.11.23
HP-UX B.11.31

HP-UX RBAC Unspecified Local Unauthorized Access Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP-UX RBAC Unspecified Local Unauthorized Access Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


HP HP-UX B.11.23

• HP AccessControl_B.11.23.06_HP-UX_B.11.23_IA+PA.depot
  http://itrc.hp.com

HP-UX RBAC Unspecified Local Unauthorized Access Vulnerability

References:

• HP-UX Homepage (HP)
  
• HPSBUX02457 SSRT090174 rev.1 - HP-UX Running Role-Based Access Control (RBAC), L ([email protected])