PT-2003-1246 · Hewlett Packard · Ucx+2

Published 2003-04-02 · Updated 2008-09-05 · CVE-2002-1513

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HP TCP/IP services for OpenVMS versions 4.2 through 5.3

Description The issue allows local users to truncate arbitrary files due to the UCX POP server running with SYSPRV and BYPASS privileges, which overrides file system permissions. This can be achieved via the -logfile command line option.

Recommendations For HP TCP/IP services for OpenVMS versions 4.2 through 5.3, consider restricting access to the -logfile command line option to prevent unauthorized file truncation until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2002-1513

Affected Products

Hp Tcp/Ip Services For Openvms

Openvms

Ucx

References · 7

• 🔥 http://online.securityfocus.com/archive/1/293070 · Exploit
• 🔥 http://securityfocus.com/bid/5790 · Exploit
• 🔥 https://exploit-db.com/exploits/21856 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1513 · Security Note
• http://archives.neohapsis.com/archives/compaq/2002-q4/0000.html · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2002-10/0010.html · Vendor Advisory
• http://iss.net/security_center/static/10236.php · Vendor Advisory