HP-UX logins command unauthorized access
| hpux-logins-unauthorized-access (36702) |  High Risk |
Description:
HP-UX could allow a remote attacker to gain unauthorized access to the system, caused by an error in the logins command when reporting the password status. An attacker could exploit this vulnerability to gain unauthorized access to the system.
Platforms Affected:
- HP, HP-UX 11.11
- HP, HP-UX 11.23
- HP, HP-UX 11.31
Remedy:
Refer to HPSBUX02259 SSRT071439 for patch, upgrade, or suggested workaround information. See References.
Consequences:
Gain Access
References:
- HPSBUX02259 SSRT071439, HP-UX Running logins(1M), Remote Unauthorized Access at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01167886&jumpid=reg_R1002_USEN.
- ASA-2007-395: HP-UX Running logins (1M), Remote Unauthorized Access (HPSBUX02259)
- BID-25740: HP-UX Logins Command Remote Unauthorized Access Vulnerability
- CVE-2007-5008: The logins command in HP-UX B.11.31, B.11.23, and B.11.11 does not correctly report password status, which allows remote attackers to obtain privileges when certain password issues are not detected.
- FrSIRT/ADV-2007-3230: HP-UX logins Command Password Status Unauthorized Access Issue
- SA26873: HP-UX logins(1M) Command Security Issue
- SECTRACK ID: 1018709: HP-UX Incorrect Password Status Bug in logins Command Lets Remote User Gain Access
Reported:
Sep 18, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net