Executive brief
A vulnerability in the 'chfn' command on older HP-UX operating systems allows a local user to gain full administrative (root) control of the system. The 'chfn' tool is used by users to change their finger information, such as their full name or office location. By providing an unexpectedly long input to this command, an attacker can crash the program and execute malicious code with elevated privileges, potentially leading to a complete system takeover.
Technical details
A stack-based buffer overflow exists in the 'chfn' utility, a setuid root program used to change user information. The vulnerability is triggered when the application fails to perform adequate bounds checking on command-line arguments. A local attacker can exploit this by passing a specially crafted, overly long string as an argument, allowing them to overwrite the return address on the stack and redirect execution flow. Because the binary is setuid root, successful exploitation results in arbitrary code execution with root privileges. This affects HP-UX versions 9.X through 10.20.
Affected products
- HP HP-UX 9.X through 10.20
Timeline
- 1996-12-09: disclosed: Exploit posted to Bugtraq mailing list by Aleph One
- 1996-12-13: advisory: NVD published date