Vulnerability for the HP-UX 11 * (export)

[Ben Curran]

We identified a vulnerability in the versions 11 x (HP-UX). We saw that to the we create a bill without any privilege could become root with only two commands, these are export PS4 = '--> ' soon afterwards digitar.pg - it will generate an error message, masi is enough to type whoami that you will see that this bill became root, and the worst is that when typing the who you will see that the bill without privilege will be logada and you won't get to see that she will be as root.

How can I solve this vulnerability?

[Steven E. Protter]

Modify the permissions and ownership on the file so that only authorized users can access the file.

Contact HP and report with greater detail on the vulnerability and their security team may open a call and document it.

AS it stands now you've not given enough information on the process of creating the vulnerability for me to give further help.

SEP

[John Morris]

Steven is correct. Please send e-mail to security-alert@hp.com.