Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2003-0089 — Improper Restriction of Operations within the Bounds of a Memory Buffer in HP Hp-ux

4 documents4 sources

Severity

7.2HIGHNVD

EPSS

0.3%

top 48.53%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

HP Hp-ux

Timeline

PublishedDec 15

Latest updateApr 29

Description

Buffer overflow in the Software Distributor utilities for HP-UX B.11.00 and B.11.11 allows local users to execute arbitrary code via a long LANG environment variable to setuid programs such as (1) swinstall and (2) swmodify.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages1 packages

▶NVDhp/hp-ux11.00, 11.11+1

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

GHSA

GHSA-c53j-6qpq-4xm2: Buffer overflow in the Software Distributor utilities for HP-UX B↗2022-04-29

▶

CVEList

CVE-2003-0089: Buffer overflow in the Software Distributor utilities for HP-UX B↗2003-11-18

▶

💥Exploits & PoCs

Exploit-DB

HP-UX 11 - Software Distributor Lang Environment Variable Local Buffer Overrun↗2002-12-11

▶