CVE-2004-1375

Vulnerability

An unknown vulnerability exists in the System Administration Manager (SAM) on HP-UX B.11.00, B.11.11, B.11.22, and B.11.23. The affected filesets include InternetSrvcs.INETSVCS-BOOT, OS-Core.UX-CORE, SystemAdmin-OBAM-RUN, and System.Admin.SAM (depending on the version) [1]. The exact nature of the flaw is not publicly disclosed, but it is reachable by a local user through the SAM interface.

Exploitation

A local attacker needs only a user account on the affected HP-UX system. No special privileges or authentication are required beyond standard local access. The attacker can trigger the vulnerability by using the SAM command or related utilities, leading to privilege escalation. The specific steps are not detailed in the available references [1].

Impact

Successful exploitation allows a local attacker to gain elevated privileges, potentially root-level access, on the affected HP-UX system. This could lead to full compromise of the system, including access to sensitive data and the ability to modify system configuration [1].

Mitigation

HP has released patches to address this vulnerability: PHCO_28125 for B.11.00, PHSS_31240 for B.11.11, PHSS_31243 for B.11.22, and PHSS_31817 for B.11.23 [1]. Administrators should apply the appropriate patch as soon as possible. No workaround is mentioned in the available references [1].