HP-UX chfn buffer overflow can compromise root privileges
| hp-chfn (2008) |  High Risk |
Description:
A buffer overflow in the HP-UX chfn command could allow a local attacker to gain unauthorized root privileges.
Consequences:
Gain Privileges
Remedy:
For HP-UX 9.x:
Apply the PHCO_9595 patch, as listed in Hewlett-Packard Security Bulletin HPSBUX9701-049. See References.
For HP-UX 10.00, 10.01, and 10.10:
Apply the PHCO_9596 patch, as listed in Hewlett-Packard Security Bulletin HPSBUX9701-049. See References.
For HP-UX 10.20:
Apply the PHCO_9597 patch, as listed in Hewlett-Packard Security Bulletin HPSBUX9701-049. See References.
References:
- AusCERT Advisory AA-96.18: HP-UX chfn Buffer Overrun Vulnerability.
- BugTraq Mailing List, Mon, 9 Dec 1996 02:47:46 -0600: the HP Bug of the Week!.
- CIAC Information Bulletin H-16: HP-UX Security Vulnerabilities (chfn, Remote Watch).
- CIAC Information Bulletin H-21: HP Security Vulnerabilities (newgrp, authentication, password, GlancePlus, chsh, chfn).
- Hewlett-Packard Company Security Bulletin HPSBUX9701-049: Security Vulnerability in chfn executable.
- CVE-1999-1089: Buffer overflow in chfn command in HP-UX 9.X through 10.20 allows local users to gain privileges via a long command line argument.
Platforms Affected:
- HP HP-UX 10.00
- HP HP-UX 10.01
- HP HP-UX 10.10
- HP HP-UX 10.20
- HP HP-UX 9.00
- HP HP-UX 9.01
- HP HP-UX 9.03
- HP HP-UX 9.04
- HP HP-UX 9.05
- HP HP-UX 9.06
- HP HP-UX 9.07
- HP HP-UX 9.08
- HP HP-UX 9.09
- HP HP-UX 9.10
Reported:
Dec 09, 1996
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net