CVE-1999-0961: Medium severity HPE HP-UX vulnerability

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove HP-UX sysdiag from your environment.

   If sysdiag is not required, uninstall or remove the sysdiag binary from HP-UX systems to prevent local users exploiting the symlink attack during log file creation.

2. Configuration

   Restrict execution of the sysdiag binary so only trusted/administrative accounts can run it (e.g., remove execute permission for unprivileged users or apply ACLs to limit who can execute sysdiag).

   HP-UX sysdiag executable file permissions / access = restricted to administrators
3. Compensating control

   Prevent unprivileged users from creating or manipulating symlinks in locations where sysdiag writes logs and restrict write access to sysdiag log directories; limit local user accounts and enforce least privilege to reduce risk of local exploitation.

4. Operational

   If exploitation is suspected (local users obtaining root), assume potential compromise: investigate and remediate affected systems, rotate any exposed credentials, and rebuild or restore systems from known-good backups as appropriate.

Event History

Frequently Asked Questions