CVE-2000-0083: Medium severity HPE HP-UX vulnerability
HP asecure creates the Audio Security File audio.sec with insecure permissions, which allows local users to cause a denial of service or gain additional privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the filesystem permissions/ACLs on the audio.sec file created by HP asecure so that non-privileged local users cannot read or modify it. Ensure only trusted administrative accounts have access.
HP asecure (Audio Security File) file permissions for audio.sec = restrict access to prevent non-privileged local users from reading or modifying the file - Compensating control
Until permissions are corrected, apply host-based controls such as filesystem ACLs, mandatory access controls, or restrict local account capabilities to prevent untrusted local users from accessing or modifying audio.sec.
- Operational
Locate all instances of audio.sec on affected HP-UX systems, verify and correct their permissions as above, and audit local accounts for any signs of misuse. Investigate any potential denial-of-service or privilege escalation activity and perform incident response if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0083?
CVE-2000-0083 is classified as a moderate severity vulnerability due to its potential for causing denial of service and privilege escalation.
How do I fix CVE-2000-0083?
To fix CVE-2000-0083, ensure that proper permissions are set on the Audio Security File audio.sec to prevent unauthorized access.
Which versions of HP-UX are affected by CVE-2000-0083?
CVE-2000-0083 affects HP-UX versions 10 and 11.
Can CVE-2000-0083 be exploited remotely?
CVE-2000-0083 cannot be exploited remotely as it requires local access to the affected system.
What types of attacks are possible with CVE-2000-0083?
CVE-2000-0083 can allow local users to execute denial of service attacks or escalate their privileges on the system.