HP Tru64 UUCP Local Buffer Overflow Vulnerability
BID:5745
Info
HP Tru64 UUCP Local Buffer Overflow Vulnerability
| Bugtraq ID: | 5745 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-1127 |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 18 2002 12:00AM |
| Updated: | Jul 11 2009 05:06PM |
| Credit: | Discovery credited to Euan Briggs ([email protected]) |
| Vulnerable: |
Digital UNIX 3.2 G Digital UNIX 3.0 Digital OSF/1 3.2 G Digital OSF/1 3.2 F Digital OSF/1 3.2 DE2 Digital OSF/1 3.2 DE1 Digital OSF/1 3.2 D Digital OSF/1 3.2 C Digital OSF/1 3.2 B Digital OSF/1 3.2 Digital OSF/1 3.0 B Digital OSF/1 3.0 |
| Not Vulnerable: | |
Discussion
HP Tru64 UUCP Local Buffer Overflow Vulnerability
Tru64 is a commercially available Unix operating system originally developed by Digital. It is distributed and maintained by HP.
A buffer overflow has been discovered in the UUCP utility, which is setuid by default. This issue may be exploited by passing an overly long string to the '-s' command line argument.
By exploiting this issue sensitive stack information is corrupted, and arbitrary attacker-supplied code can be executed.
Tru64 is a commercially available Unix operating system originally developed by Digital. It is distributed and maintained by HP.
A buffer overflow has been discovered in the UUCP utility, which is setuid by default. This issue may be exploited by passing an overly long string to the '-s' command line argument.
By exploiting this issue sensitive stack information is corrupted, and arbitrary attacker-supplied code can be executed.
Solution / Fix
HP Tru64 UUCP Local Buffer Overflow Vulnerability
Solution:
The official vendor response, is to upgrade to one of the later versions of Tru64, as they are not vulnerable to this issue.
At the time of this writing the latest version of Tru64 is v5.1a
Solution:
The official vendor response, is to upgrade to one of the later versions of Tru64, as they are not vulnerable to this issue.
At the time of this writing the latest version of Tru64 is v5.1a