HP-UX VJE.VJE-RUN Default Path Modification Vulnerability

Bugtraq ID:	5583
Class:	Environment Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 28 2002 12:00AM
Updated:	Aug 28 2002 12:00AM
Credit:	Published in an HP Security Bulletin.
Vulnerable:	HP HP-UX 11.0
Not Vulnerable:

HP-UX VJE.VJE-RUN Default Path Modification Vulnerability

HP-UX is the Unix Operating System variant distributed and maintained by HP. An issue has been reported with the VJE.VJE-RUN fileset used to provide vje Japanese Input support.

When installed, VJE.VJE-RUN modifies the file /etc/PATH. The string 'bin' is erroneously added to this file. As a result, the PATH environment variable for users and processes may be modified in unexpected ways.

A malicious local user may be able to exploit this issue to gain elevated privileges.

HP-UX VJE.VJE-RUN Default Path Modification Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HP-UX VJE.VJE-RUN Default Path Modification Vulnerability

Solution:
HP has issued a revised advisory. Patch PHSS_27782 is available.


HP HP-UX 11.0

• HP PHSS_27782
  http://itrc.hp.com

HP-UX VJE.VJE-RUN Default Path Modification Vulnerability

References: