Cluster 04: VEN-HP

["Steven M. Christey" <coley@linus.mitre.org>]

This cluster has 11 vulnerabilities.

------------------------------------------
Candidate: CAN-1999-0057
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SNI:SNI-19
Reference: XF:vacation
Reference: HP:HPSBUX9811-087

Vacation program allows command execution by remote users through
a sendmail command.

------------------------------------------
Candidate: CAN-1999-0309
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: XF:hpux-vgdisplay
Reference: CIAC:H-27: HP-UX vgdisplay Buffer Overrun Vulnerability

HP-UX vgdisplay program gives root access to local users

------------------------------------------
Candidate: CAN-1999-0326
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: HP:HPSBUX9710-071

Vulnerability in HP-UX mediainit program

------------------------------------------
Candidate: CAN-1999-0353
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: HP:HPSBUX9902-091
Reference: CIAC:J-026

rpc.pcnfsd in HP gives remote root access by changing the permissions
on the main printer spool directory.

------------------------------------------
Candidate: CAN-1999-0423
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: HP:HPSBUX9903-093

Vulnerability in hpterm on HP-UX 10.20 allows local users to gain
additional privileges.

------------------------------------------
Candidate: CAN-1999-0432
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: HP:HPSBUX9903-094

ftp on HP-UX 11.00 allows local users to gain privileges.

------------------------------------------
Candidate: CAN-1999-0436
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: HP:HPSBUX9903-095

Domain Enterprise Server Management System (DESMS) in HP-UX allows
local users to gain privileges.

------------------------------------------
Candidate: CAN-1999-0447
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: HP:HPSBMP9904-006

Local users can gain privileges using the debug utility in the MPE/iX
operating system.

------------------------------------------
Candidate: CAN-1999-0478
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: HP:HPSBUX9904-097

Denial of service in HP-UX sendmail 8.8.6 related to accepting
connections.

------------------------------------------
Candidate: CAN-1999-0479
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: HP:HPSBUX9903-092

Denial of service Netscape Enterprise Server with VirtualVault  on
HP-UX VVOS systems.

------------------------------------------
Candidate: CAN-1999-0551
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: CF
Reference: HP:HPSBUX9804-078
Reference: XF:hp-openmail

HP OpenMail can be misconfigured to allow users to run arbitrary
commands using malicious print requests.