PT-2014-4833 · Hewlett Packard · Hp Nonstop Safeguard Security

Published 2014-08-12 · Updated 2017-01-07 · CVE-2014-2629

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HP NonStop Safeguard Security Software G versions H06.03 through H06.28.01 HP NonStop Safeguard Security Software G versions J06.03 through J06.17.01

Description The issue is related to the improper evaluation of the DISKFILE-PATTERN ACL of a program object file. This allows remote authenticated users to bypass intended restrictions on program access via vectors related to process-creation time.

Recommendations For versions H06.03 through H06.28.01, update to a version that properly evaluates the DISKFILE-PATTERN ACL to prevent unauthorized access. For versions J06.03 through J06.17.01, update to a version that properly evaluates the DISKFILE-PATTERN ACL to prevent unauthorized access.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-2629

Affected Products

Hp Nonstop Safeguard Security

References · 5

• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=c04391893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2629 · Security Note
• http://secunia.com/advisories/59981 · Note
• http://securityfocus.com/bid/69147 · Note
• http://securitytracker.com/id/1030697 · Note