发布时间 :2000-12-19 00:00:00
修订时间 :2008-09-05 16:22:18

[原文]Buffer overflows in lpspooler in the fileset PrinterMgmt.LP-SPOOL of HP-UX 11.0 and earlier allows local users to gain privileges.

[CNNVD]HP-UX PrinterMgmt.LP-SPOOL文件集lpspooler缓冲区溢出漏洞(CNNVD-200012-112)

        HP-UX 11.0及其早期版本的PrinterMgmt.LP-SPOOL文件集的lpspooler存在缓冲区溢出漏洞。本地用户利用该漏洞提升特权。

- CVSS (基础分值)

CVSS分值: 4.6 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:hp:hp-ux:11.00HP-UX 11.00
cpe:/o:hp:hp-ux:10.00HP HP-UX 10.00

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:5730The lpspool subsystem has various security oriented defects.

- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(VENDOR_ADVISORY)  XF  hp-lpspooler-bo

- 漏洞信息

HP-UX PrinterMgmt.LP-SPOOL文件集lpspooler缓冲区溢出漏洞
中危 缓冲区溢出
2000-12-19 00:00:00 2005-05-02 00:00:00
        HP-UX 11.0及其早期版本的PrinterMgmt.LP-SPOOL文件集的lpspooler存在缓冲区溢出漏洞。本地用户利用该漏洞提升特权。

- 公告与补丁


- 漏洞信息

HP-UX PrinterMgmt.LP-SPOOL lpspooler Local Overflow
Local Access Required Input Manipulation
Loss of Integrity Patch / RCS
Exploit Unknown

- 漏洞描述

A local overflow exists in HP-UX PrinterMgmt.LP-SPOOL package. The lpspooler utility fails to validate input correctly resulting in a buffer overflow. With a specially crafted request, an attacker can elevate privileges resulting in a loss of integrity.

- 时间线

2000-10-16 Unknow
Unknow Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Hewlett-Packard Company has released a patch to address this vulnerability. The OS version and patches are listed below. HP-UX 11.00: PHCO_22365 HP-UX 10.20: PHCO_22364 HP-UX 10.10: PHCO_22411 HP-UX 10.01: PHCO_22410

- 相关参考

- 漏洞作者

Unknown or Incomplete