PT-2002-2342 · Hewlett Packard · Hp Tru64 Unix

Publicado 2002-12-31 · Atualizado 2011-03-08 · CVE-2002-1617

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Tru64 UNIX versions 5.x

Description The issue allows local users to execute arbitrary code due to multiple buffer overflows. This can be achieved through various means, including a long -contextDir argument to dtaction, a long -p argument to dtprintinfo, a long -customization argument to dxterm, or a long DISPLAY environment variable to dtterm.

Recommendations For HP Tru64 UNIX version 5.x, consider disabling the dtaction, dtprintinfo, dxterm, and dtterm functions until a patch is available to prevent exploitation. Restrict access to these functions to minimize the risk of arbitrary code execution. Avoid using long arguments for -contextDir, -p, and -customization, as well as long DISPLAY environment variables, in the affected applications.

Exploit

Correção

Identificadores relacionados

CVE-2002-1617

Produtos afetados

Hp Tru64 Unix

Referências · 11

• 🔥 http://blacksheepnetworks.com/security/hack/tru64/TRU64_dtprintinfo.txt · Exploit
• 🔥 http://blacksheepnetworks.com/security/hack/tru64/TRU64_dxterm.txt · Exploit
• 🔥 http://blacksheepnetworks.com/security/hack/tru64/TRU64_dtterm.txt · Exploit
• 🔥 http://blacksheepnetworks.com/security/hack/tru64/TRU64_dtaction.txt · Exploit
• http://kb.cert.org/vuls/id/931579 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html · Nota
• http://kb.cert.org/vuls/id/202939 · Nota
• http://securityfocus.com/archive/1/290115 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/600699 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1617 · Nota de Segurança
• http://kb.cert.org/vuls/id/836275 · Nota