HP-UX 'disable' Local Buffer Overflow Vulnerability

Bugtraq ID:	6845
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 13 2003 12:00AM
Updated:	Feb 13 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to "Davide Del Vecchio" <[email protected]>.
Vulnerable:	HP HP-UX 11.0
Not Vulnerable:

HP-UX 'disable' Local Buffer Overflow Vulnerability

It has been reported that a vulnerability exists in the HP-UX 'disable' utility that may cause memory corruption. This issue occurs when passing a string of excessive length as the '-r' command-line argument.

Although it has not been confirmed, it may be possible to exploit this issue to execute commands. If this situation were to occur an attacker may run arbitrary commands with 'lp' privileges.

HP-UX 'disable' Local Buffer Overflow Vulnerability

Solution:
HP has announced that the fixes supplied for a previous lp vulnerability also fix the described issue. Users are advised to apply the necessary fixes supplied in the attached HPSBUX0208-213 security bulletin.

HP-UX 'disable' Local Buffer Overflow Vulnerability

References:

• HPUX disable buffer overflow vulnerability ("Davide Del Vecchio" )
  
• HPUX disable buffer overflow vulnerability (HP S/W Security Team )