PT-2007-1624 · Digital Equipment · Decnet/Osi

Published 2007-01-09 · Updated 2011-03-08 · CVE-2007-0139

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DECnet/OSI versions 7.3 through 7.3-2

Description The issue allows attackers to obtain unintended privileged access to data and system resources. It is related to the following components: (1) [SYSEXE]CTF$UI.EXE, (2) [SYSMSG]CTF$MESSAGES.EXE, (3) [SYSHLP]CTF$HELP.HLB, and (4) [SYSMGR]CTF$STARTUP.COM.

Recommendations For DECnet/OSI versions 7.3 through 7.3-2, consider restricting access to the affected components, such as [SYSEXE]CTF$UI.EXE, [SYSMSG]CTF$MESSAGES.EXE, [SYSHLP]CTF$HELP.HLB, and [SYSMGR]CTF$STARTUP.COM, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-0139

Affected Products

Decnet/Osi

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-0139 · Security Note
• ftp://ftp.itrc.hp.com/openvms_patches/vax/V7.3/VAX_DNVOSIMUP01-V0703.txt · Patch
• http://secunia.com/advisories/23636 · Vendor Advisory
• ftp://ftp.itrc.hp.com/openvms_patches/alpha/V7.3-2/AXP_DNVOSIMUP01-V0703-2.txt · Patch
• http://osvdb.org/32585 · Note
• http://osvdb.org/32583 · Note
• http://osvdb.org/32584 · Note
• http://osvdb.org/32586 · Note
• http://vupen.com/english/advisories/2007/0063 · Note