HP-UX SD Buffer Overflow Vulnerability

Bugtraq ID:	545
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 26 1999 12:00AM
Updated:	Jul 26 1999 12:00AM
Credit:	This vulnerability was exposed in HP Advisory HPSBUX9907-101, published on July 26, 1999.
Vulnerable:	HP SD-UX 10.10 B - HP HP-UX 10.34 - HP HP-UX 10.30 - HP HP-UX 10.20 - HP HP-UX 10.16 - HP HP-UX 10.10 - HP HP-UX 10.9 - HP HP-UX 10.8 - HP HP-UX 10.1 0 - HP HP-UX 10.0 HP SD-OV 1.2 A - HP HP-UX 10.20 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 3.5 HP SD-OV 1.1 A - HP HP-UX 10.10 - HP HP-UX 10.1 0 HP SD-OV 1.0 A - IBM AIX 4.2 - IBM AIX 4.1 - IBM AIX 3.2 - Siemens Nixdorf SNI 5.42 - Sun Solaris 2.5 - Sun Solaris 2.4 - Sun Solaris 2.3 - Sun SunOS 4.1 HP HP-UX (VVOS) 10.24 HP HP-UX 11.0
Not Vulnerable:

HP-UX SD Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

HP-UX SD Buffer Overflow Vulnerability

Solution:
Install the applicable patch:

SD-UX version B.10.10 on HP-UX release 10.01, 10.10: PHCO_15205
SD-OV version A.01.01 on HP-UX release 10.01, 10.10: PHCO_15205
SD-UX version B.10.20 on HP-UX release 10.20: * PHCO_15206
SD-OV version A.01.02 on HP-UX release 10.20: * PHCO_15206
HP-UX release 10.24: PHCO_19120
HP-UX release 11.00: * PHCO_18183

NOTE: There will be no patches for 10.00 nor 10.30.

From http://ovweb.external.hp.com, retrieve the following:

SDOV version A.01.02 for NT 3-4X: SDOV_00005

SDOV version A.01.00 sparcSUN 4.1: SDOV_00006
SDOV version A.01.00 sparcSOL 2.3: SDOV_00007
SDOV version A.01.00 sparcSOL 2.4: SDOV_00008
SDOV version A.01.00 sparcSOL 2.5: SDOV_00009

SDOV version A.01.00 AIX 3.2: SDOV_00010
SDOV version A.01.00 AIX 4.1: SDOV_00011
SDOV version A.01.00 AIX 4.2: SDOV_00012

SDOV version A.01.00 SNI5.42: SDOV_00013