CVE-2006-2574

Vulnerability

The vulnerabilities exist in HP-UX Software Distributor (SD) on versions B.11.00, B.11.04, B.11.11, and B.11.23 [1]. Multiple unspecified flaws allow local users to gain privileges via unknown attack vectors [2]. The exact conditions and configuration required are not publicly detailed, but local access to the system is necessary.

Exploitation

A local user with shell access to the affected HP-UX system can exploit these vulnerabilities without additional authentication or user interaction [1]. The specific steps are not disclosed in the available references, but the attack vectors are local in nature.

Impact

Successful exploitation enables a local user to gain elevated privileges, likely root, compromising the confidentiality, integrity, and availability of the system [2].

Mitigation

HP released patches to address these issues: for HP-UX B.11.00, install patch PHCO_34568; for HP-UX B.11.11, install patch PHCO_34539 [2]. Users of other affected versions should apply corresponding patches from HP. The Avaya advisory ASA-2006-106 references these patches [2]. No workarounds are documented; applying the appropriate patch is recommended.