PT-2018-6522 · Hewlett Packard · Openvms+2

Simon Clubley · Publicado 2018-02-07 · Atualizado 2018-08-13 · CVE-2017-17482

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenVMS versions prior to V8.4-2L2 on Alpha OpenVMS versions prior to V8.4-2L1 on IA64 VAX/VMS versions 4.0 and later

Description: A malformed DCL command table may result in a buffer overflow, allowing a local privilege escalation when a non-privileged account enters a crafted command line. This issue is exploitable on VAX and Alpha and may cause a process crash on IA64.

Recommendations: For OpenVMS versions prior to V8.4-2L2 on Alpha, update to version V8.4-2L2 or later to resolve the issue. For OpenVMS versions prior to V8.4-2L1 on IA64, update to version V8.4-2L1 or later to resolve the issue. For VAX/VMS versions 4.0 and later, consider restricting access to the DCL command table to minimize the risk of exploitation until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-17482

Produtos afetados

Dcl

Openvms

Vax/Vms

Referências · 5

• https://theregister.co.uk/2018/02/06/openvms_vulnerability · Nota
• https://groups.google.com/forum/#%21topic/comp.os.vms/BYIUQ0lJ-s0 · Nota
• https://osv.dev/vulnerability/CVE-2017-17482 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-17482 · Nota de Segurança
• http://openvms.org/node/121 · Aviso do Fabricante