Executive brief
HP OpenMail, an enterprise email and collaboration platform, contains a configuration vulnerability that allows users to execute unauthorized commands. By submitting a specially crafted print request, a local user can bypass security restrictions to run arbitrary code on the system. This could lead to unauthorized access to sensitive data or a full compromise of the mail server's integrity.
Technical details
A vulnerability exists in HP OpenMail due to improper validation or handling of print requests when the system is misconfigured. A local attacker can exploit this by submitting a malicious print request designed to execute arbitrary commands with the privileges of the OpenMail service. The attack vector is local, requiring the attacker to have existing access to the system to submit the request. Successful exploitation results in a loss of confidentiality, integrity, and availability. The issue was originally identified in 1998 and is addressed in HP security advisory HPSBUX9804-078.
Affected products
- HP OpenMail
Timeline
- 1998-04-01: disclosed: Initial publication date
- 1998-04-01: advisory: HP advisory HPSBUX9804-078 released