Secunia

A vulnerability has been reported in HP-UX, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within "pfs_mountd.rpc" daemon when handling certain UDP packets. This can be exploited to cause a buffer overflow by sending two specially crafted UDP packets to the daemon.

Successful exploitation allows execution of arbitrary code.

The vulnerability is reported in versions HP-UX B.11.00 (obsolete), B.11.11 and B.11.23.

NOTE: PFS is reportedly obsolete since 2004-03-01 and no longer supported on any HP-UX release, but is supplied with HP-UX B.11.00, B.11.11, and B.11.23.

Solution
Use the enhanced CDFS and mount/umount commands by applying the patches. The vendor also recommends discontinuing the use of PFS.
Further details available in Customer Area

Provided and/or discovered by
iDefense Labs

Changelog
Further details available in Customer Area

Original Advisory
HPSBUX02203 SSRT071339:
https://www5.itrc.hp.com/service/cki/docDisplay.do?admit=-1335382922+1176288056779+28353475&docId=c00913684

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=512

Deep Links
Links available in Customer Area