HP-UX stmkfont Alternate Typeface Library Buffer Overflow Vulnerability

Bugtraq ID:	6836
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 12 2003 12:00AM
Updated:	Feb 12 2003 12:00AM
Credit:	Discovery of this vulnerability credited to LSD Research Group (http://lsd-pl.net).
Vulnerable:	HP HP-UX 11.22 HP HP-UX 11.20 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX 10.34 HP HP-UX 10.30 HP HP-UX 10.26 HP HP-UX 10.24 HP HP-UX 10.20 HP HP-UX 10.16 HP HP-UX 10.10 HP HP-UX 10.9 HP HP-UX 10.8 HP HP-UX 10.1 0 HP HP-UX 10.0 1 HP HP-UX 10.0 Avaya Predictive Dialing System (PDS) 12.0 Avaya Predictive Dialing System (PDS) 11.0 Avaya Predictive Dialing System (PDS) 9.0
Not Vulnerable:

HP-UX stmkfont Alternate Typeface Library Buffer Overflow Vulnerability

A buffer overflow vulnerability has been reported in the stmkfont utility shipped with HP-UX systems. The problem occurs due to insufficient bounds checking on user-suplied data to the alternate typeface library command-line option.

A local attacker may be able to exploit this issue to execute arbitrary code with elevated privileges.

All Avaya PDS 9 and 11 platforms are vulnerable to this issue. Avaya PDS 12 platforms running on HP-UX 11.00 are vulnerable as well. PDS 12 versions running on HP-UX 11.11 are not vulnerable.

HP-UX stmkfont Alternate Typeface Library Buffer Overflow Vulnerability

References:

• ASA-2005-032 - Update to Hewlett-Packard Security Advisories (Avaya)
  
• [LSD] HP-UX security vulnerabilities (Last Stage of Delirium )