PT-2007-1865 · Hewlett Packard · Hp-Ux

Published 2007-01-19 · Updated 2018-10-16 · CVE-2007-0394

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: HP HP-UX version B11.11

Description: The issue arises from improper verification of file descriptor status before setuid execution. This allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program.

Recommendations: For HP HP-UX version B11.11, update to a version that properly verifies file descriptor status before setuid execution to prevent privilege escalation.

Fix

Related Identifiers

CVE-2007-0394

Affected Products

Hp-Ux

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2007-0394 · Security Note
• http://securityfocus.com/archive/1/457279/100/0/threaded · Note
• http://securityfocus.com/archive/1/457315/100/0/threaded · Note