Secunia

Martin O'Neal of Corsaire has reported two vulnerabilities in HP Ignite-UX, which can be exploited by malicious people to gain access to the file system or disclose certain sensitive information.

1) An error in handling the "add_new_client" command can cause some sections of the TFTP server directory tree to become world-writable. This can be exploited to copy files to/from the file system or to cause a DoS (Denial of Service) by filling up available disk space.

2) An error in handling of the "make_recovery" command can cause a copy of the "/etc/passwd" file to be created in the TFTP server directory tree for anonymous access. The "make_recovery" has been removed as of version C.6.0, but the password file may still exist in the TFTP server directory tree if an older version has been used before.

The vulnerabilities have been reported in the following versions:
* HP-UX B.11.00 running Ignite-UX
* HP-UX B.11.11 running Ignite-UX
* HP-UX B.11.22 running Ignite-UX
* HP-UX B.11.23 running Ignite-UX

Solution
Apply updates.
Further details available in Customer Area

Provided and/or discovered by
Martin O'Neal, Corsaire Ltd.

Changelog
Further details available in Customer Area

Original Advisory
SSRT4874:
http://itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01219

Corsaire:
http://www.corsaire.com/advisories/c041123-001.txt
http://www.corsaire.com/advisories/c041123-002.txt

Deep Links
Links available in Customer Area