PT-2008-6534 · Hewlett Packard · Openvms+1

Published 2008-12-10 · Updated 2011-01-05 · CVE-2008-5417

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions HP DECnet-Plus version 8.3 before ECO03 for OpenVMS on the Alpha platform

Description The issue allows local users to bypass intended access restrictions and modify the OSIT$NAMES logical name table due to world-writable permissions. This can be achieved via the (1) SYS$CRELNM and (2) SYS$DELLNM system services.

Recommendations For HP DECnet-Plus version 8.3 before ECO03, update to ECO03 or later to resolve the issue. As a temporary workaround, consider restricting access to the SYS$CRELNM and SYS$DELLNM system services to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-5417

Affected Products

Hp Decnet-Plus

Openvms

References · 4

• http://secunia.com/advisories/33028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5417 · Security Note
• ftp://ftp.itrc.hp.com/openvms_patches/alpha/V8.3/AXP_DNVOSIECO03-V83.txt · Note
• http://securitytracker.com/id?1021364 · Note