HP-UX 11.0 /usr/lbin/rwrite

2007-10-23 / 2007-10-24

Credit: bt

Risk: High

Local: Yes

Remote: No

CVE: CVE-2003-1461

CWE: N/A

CVSS Base Score: 7.2/10

Impact Subscore: 10/10

Exploitability Subscore: 3.9/10

Exploit range: Local

Attack complexity: Low

Authentication: No required

Confidentiality impact: Complete

Integrity impact: Complete

Availability impact: Complete

Hi!

There is a vulnerability in /usr/lbin/rwrite on HP-UX 11.0 (other versions might be vulnerable too).

/usr/lbin/rwrite is installed setuid to root by default.

$ /usr/lbin/rwrite something `perl -e 'print "A" x 14628'` something
Segmentation fault

Solution : remove setuid bit until patch is available.

Tried to contact security-alert (at) hp (dot) com [email concealed] , got "Client rejected. Access denied".

Bye,

bt (at) delfi (dot) lt [email concealed]
<--------------------===========================-------------------->
Meiles zinutes sirdies damai ar riteriui: siusk MEILE numeriu 1325.
Jei siunti draugui, po zodzio MEILE nurodyk jo mob. telefono numeri.
Zinutes kaina 1 Lt.  http://sms.delfi.lt/

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

HP-UX 11.0 /usr/lbin/rwrite

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.