CVE-2002-0577
Description
Vulnerability in passwd for HP-UX 11.00 and 11.11 allows local users to corrupt the password file and cause a denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*
- cpe:2.3:o:hp:hp-ux:11.0.4:*:*:*:*:*:*:*
- cpe:2.3:o:hp:hp-ux:11.11:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
Root cause
"The /sbin/passwd command does not recover gracefully from error conditions, allowing a local user to corrupt the password file."
Attack vector
A local attacker with no authentication required can exploit the poor error handling in `/sbin/passwd` [ref_id=1]. By triggering specific error conditions during a password change operation, the command fails to recover gracefully and corrupts the system password file. This results in a denial of service because the corrupted password file prevents legitimate users from authenticating. The attack complexity is low and the impact is limited to availability (partial) [ref_id=1].
Affected code
The vulnerability resides in `/sbin/passwd` on HP-UX B.11.00, B.11.11, and B.11.23. The advisory states that "the /sbin/passwd command does not recover gracefully from some error conditions," which allows a local user to corrupt the password file and cause a denial of service [ref_id=1].
What the fix does
HP released cumulative patches for each affected version: PHCO_33219 for B.11.00, PHCO_33214/PHCO_33215 for B.11.11, and PHCO_32149/PHCO_32926 for B.11.23 [ref_id=1]. The patches address the underlying error-handling flaw so that `/sbin/passwd` properly recovers from error conditions instead of leaving the password file in an inconsistent state. The advisory does not provide a code-level diff, but the resolution is to install the specified patches from the HP ITRC portal [ref_id=1].
Preconditions
- authAttacker must have local shell access to the HP-UX system
- authNo special privileges required beyond local user access
Generated on Jun 17, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- archives.neohapsis.com/archives/hp/2002-q2/0023.htmlnvdPatchVendor Advisory
- www.iss.net/security_center/static/8939.phpnvdPatchVendor Advisory
- www.securityfocus.com/bid/4582nvdPatchVendor Advisory
- www.kb.cert.org/vuls/id/977779nvdUS Government Resource
- securityreason.com/securityalert/656nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5518nvd
News mentions
0No linked articles in our index yet.