PT-2004-1972 · Hewlett Packard · Hp-Ux+2

Martin Oneal · Published 2004-12-31 · Updated 2017-10-11 · CVE-2004-0952

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: HP-UX versions B.11.00 through B.11.23

Description: The issue allows remote attackers to modify data or cause disk consumption due to world-writable permissions being set on part of the directory tree by the TFTP server when running Ignite-UX and using the add new client command.

Recommendations: For HP-UX versions B.11.00 through B.11.23, consider restricting access to the TFTP server or modifying the permissions set by the add new client command to prevent remote attackers from modifying data or causing disk consumption. As a temporary workaround, restrict the use of the add new client command until a proper fix is applied.

Fix

Related Identifiers

CVE-2004-0952

HPSBUX01219

Affected Products

Hp-Ux

Ignite-Ux

Tftp Server

References · 9

• http://secunia.com/advisories/16456 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0952 · Security Note
• http://marc.info/?l=bugtraq&m=112422597529112&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0952 · Security Note
• http://marc.info/?l=bugtraq&m=112420609211136&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21857 · Note
• http://securitytracker.com/id?1014711 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5775 · Note
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTAzNTY4MQ%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Note