CVE-2007-0394: Medium severity HPE HP-UX vulnerability

Published Jan 19, 2007

Updated

HP HP-UX B11.11 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.

Affected Software

1 affected component

HPE HP-UX=11.11

Event History

Jan 19, 2007

CVE Published

11:28 PM

Jan 20, 2007

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0394?

CVE-2007-0394 is considered a high severity vulnerability due to its potential to allow local users to gain elevated privileges.

How do I fix CVE-2007-0394?

To mitigate CVE-2007-0394, ensure that setuid programs are designed to properly handle file descriptor verification and consider applying relevant system patches provided by HP.

Who is affected by CVE-2007-0394?

CVE-2007-0394 affects local users operating on HP-UX version 11.11.

What is the impact of CVE-2007-0394?

The impact of CVE-2007-0394 is that it allows local users to execute setuid programs with increased privileges, compromising system security.

Is there a workaround for CVE-2007-0394?

A potential workaround for CVE-2007-0394 is to restrict the use of setuid programs or implement access controls to limit local user privileges.