HP-UX IPCS Core File Buffer Overflow Vulnerability

Bugtraq ID:	7216
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Mar 27 2003 12:00AM
Updated:	May 31 2007 03:31AM
Credit:	This issue was reported by "[email protected]" <[email protected]>.
Vulnerable:	HP HP-UX 11.0
Not Vulnerable:

HP-UX IPCS Core File Buffer Overflow Vulnerability

The HP-UX 'ipcs' utility is prone to a locally exploitable buffer-overflow condition because the software fails to properly bounds-check core filenames. This utility may be installed setgid 'sys' on vulnerable systems; attackers may exploit this issue to gain these privileges.

This issue was reported with 'ipcs' on HP-UX 11.00; other versions are also likely affected.

HP-UX IPCS Core File Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

HP-UX IPCS Core File Buffer Overflow Vulnerability

Solution:
Reportedly, this issue has been addressed in 'ipcs' patch PHCO_18374, which was released in 1999. Users should contact the vendor for details on obtaining fixes.

HP-UX IPCS Core File Buffer Overflow Vulnerability

References:

• HP IT Resource Center (for Europe) (HP IT Resource Center)
  
• HP IT Resource Center (for US, Canada, Asia-Pacific, & Latin-America) (HP IT Resource Center)