PT-2002-2342 · Hewlett Packard · Hp Tru64 Unix

Published 2002-12-31 · Updated 2011-03-08 · CVE-2002-1617

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Tru64 UNIX versions 5.x

Description The issue allows local users to execute arbitrary code due to multiple buffer overflows. This can be achieved through various means, including a long -contextDir argument to dtaction, a long -p argument to dtprintinfo, a long -customization argument to dxterm, or a long DISPLAY environment variable to dtterm.

Recommendations For HP Tru64 UNIX version 5.x, consider disabling the dtaction, dtprintinfo, dxterm, and dtterm functions until a patch is available to prevent exploitation. Restrict access to these functions to minimize the risk of arbitrary code execution. Avoid using long arguments for -contextDir, -p, and -customization, as well as long DISPLAY environment variables, in the affected applications.

Exploit

Fix

Related Identifiers

CVE-2002-1617

Affected Products

Hp Tru64 Unix

References · 11

• 🔥 http://blacksheepnetworks.com/security/hack/tru64/TRU64_dtprintinfo.txt · Exploit
• 🔥 http://blacksheepnetworks.com/security/hack/tru64/TRU64_dxterm.txt · Exploit
• 🔥 http://blacksheepnetworks.com/security/hack/tru64/TRU64_dtterm.txt · Exploit
• 🔥 http://blacksheepnetworks.com/security/hack/tru64/TRU64_dtaction.txt · Exploit
• http://securityfocus.com/archive/1/290115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1617 · Security Note
• http://kb.cert.org/vuls/id/931579 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1203.html · Note
• http://kb.cert.org/vuls/id/202939 · Note
• http://kb.cert.org/vuls/id/600699 · Note
• http://kb.cert.org/vuls/id/836275 · Note