CVE-2000-0078: High severity HPE HP-UX vulnerability
The June 1999 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the awk command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the aserver program or its invocation environment so it does not rely on the user's PATH to find awk. Ensure aserver invokes awk via an absolute path (for example /usr/bin/awk) and/or clears/sanitizes the PATH environment variable to remove directories writable by unprivileged users before executing external commands.
HP-UX aserver PATH / awk invocation = use absolute path to awk; sanitize PATH to exclude untrusted directories - Compensating control
Prevent local unprivileged users from influencing the PATH used by aserver: ensure directories in the PATH are not writable by unprivileged users, run aserver in a restricted execution environment with a safe fixed PATH, or otherwise restrict who can modify the execution environment for aserver.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0078?
CVE-2000-0078 has a medium severity rating as it allows local users to escalate privileges.
How do I fix CVE-2000-0078?
To fix CVE-2000-0078, ensure that proper permissions are set on the aserver program and restrict the PATH variable usage.
Which versions of HP-UX are affected by CVE-2000-0078?
CVE-2000-0078 affects HP-UX versions 10 and 11.
What is the impact of CVE-2000-0078?
The impact of CVE-2000-0078 is that local users can gain unauthorized privileges on the system.
Is there a workaround for CVE-2000-0078?
A potential workaround for CVE-2000-0078 is to avoid using the aserver program if the risk cannot be mitigated.