HPSBUX0010-125 Vulnerability in lpspooler

[Jim Barden]

Can anyone tell me what actions or reasons a memory buffer overflow might occur? And what increased priviledges a user might receive?

[Kofi ARTHIABAH]

Everytime some sort of limit is set of a variable (or block of memory etc.) there is the possibility that if more data (or poorly formatted data) is passed to a program, it would behave eratically. In some cases, a buffer overflow may dump core or even provide a shell for malacious commands to be executed (that is really scary). If a buffer overflow occurs and a shell is provided to execute commands, the priviledges of the malacious user would be equivalent to the program that is running (so if the program is running as root, then your malacious user has root previledges - and you do not want that!)

There is an interesting write-up on How 'buffer overflow' attacks work

http://www.securityfocus.com/templates/library.html?id=2735

good luck

[CHRIS_ANORUO]

Download and install patch PHCO_22364 for 10.20. This Patch has addressed the problem that you are experiencing.