Description
Buffer overflow in the Software Distributor utilities for HP-UX B.11.00 and B.11.11 allows local users to execute arbitrary code via a long LANG environment variable to setuid programs such as (1) swinstall and (2) swmodify.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- HP-UX 11 - Software Distributor Lang Environment Variable Local Buffer Overrun EDB-23343 · local · Dec 11, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20031113 NSFOCUS SA2003-07: HP-UX Software Distributor Buffer Overflow Vulnerability mailing-list
- 8986 vdb-entry
- 20031113 NSFOCUS SA2003-07: HP-UX Software Distributor Buffer Overflow Vulnerability mailing-list
- hp-sd-utilities-bo(13623) vdb-entry
- HPSBUX0311-293 vendor-advisory
- oval:org.mitre.oval:def:5466 vdb-entry signature