topic Re: Potential Security Vulnerability in kermit in Operating System - HP-UX

Potential Security Vulnerability in kermit

Berlene Herren — Mon, 19 May 2003 11:17:07 GMT

=================================================================
A security bulletin has been issued:

-----------------------------------------------------------------
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0305-259
Originally issued: 18 May 2003
SSRT3555 Potential Security Vulnerability in kermit

-----------------------------------------------------------------

To access the bulletin from the itrc:

Select "maintenance and support"
Select "search technical knowledge base"
Select "HP-UX Software Security Bulletins"
Select "Search by Security Bulletin Number"
Enter "HPSBUX0305-259"
Search

The complete list of security bulletins can be found here:

http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin
=================================================================
Berlene

Re: Potential Security Vulnerability in kermit

Stefan Farrelly — Mon, 19 May 2003 11:24:46 GMT

just shoot the frog then.........

Re: Potential Security Vulnerability in kermit

enrico.nic — Tue, 20 May 2003 07:00:35 GMT

As stated by the security bulletin, a
# chmod 444 /usr/bin/kermit
should fix the problem, removing the suid execution permit. After that, "Full functionality will be available only to the root user."
Shouldn't it be chmod 555 ? How can root execute a program with read only permits ?

Re: Potential Security Vulnerability in kermit

John Morris — Tue, 20 May 2003 10:44:07 GMT

Yes, it should have been 555. Sorry.