Christer Öberg, Claes Nyberg, and James Tusini have reported a vulnerability in HP TCP/IP Services for OpenVMS, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a format string error in the finger client and can be exploited via specially crafted ".plan" or ".project" files placed in the attacker's home directory.

Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into connecting to a malicious finger server.

Solution
Do not run the finger client against untrusted finger servers.

Provided and/or discovered by
Christer Öberg, Claes Nyberg, and James Tusini

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://deathrow.vistech.net/DEFCON16/VMS.PDF

Deep Links
Links available to Secunia VIM customers