Actu
Vigil@nce: HP-UX, file access via useradd
April 2009 by Vigil@nce
After running the useradd command, a local attacker can access to
some files.
– Severity: 1/4
– Consequences: data reading, data creation/edition
– Provenance: user shell
– Means of attack: no proof of concept, no attack
– Ability of attacker: expert (4/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Creation date: 28/04/2009
IMPACTED PRODUCTS
– HP-UX
DESCRIPTION OF THE VULNERABILITY
The useradd command adds users on the system. The
/etc/default/useradd file indicates default parameters:
– HOMEDIR : home directory
– GROUPID : gid
– etc.
When /etc/default/useradd is missing, or when HOMEDIR/GROUPID
parameters are not defined, the useradd command associates an
invalid homedir/gid to the user. The user can then access to
resources that he should not have access to.
After running the useradd command, a local attacker can therefore
access to some files, if his parameters are incorrect.
CHARACTERISTICS
– Identifiers: c01539431, HPSBUX02366, SSRT080120, VIGILANCE-VUL-8676
– Url: http://vigilance.fr/vulnerability/HP-UX-file-access-via-useradd-8676
To change your email preferences (frequency, severity threshold, format):
https://vigilance.fr/?action=2041549901&langue=2
