Vulnerability CVE-1999-0336

Vulnerability Name:

CVE-1999-0336 (CCN-1439)

Assigned:

1996-11-01

Published:

1996-11-01

Updated:

2022-08-17

Summary:

Buffer overflow in mstm in HP-UX allows local users to gain root access.

CVSS v3 Severity:

9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-Other

Vulnerability Consequences:

Gain Privileges

References:

Source: CCN
Type: BugTraq Mailing List, Sat, 16 Nov 1996 11:38:33 -0800
This week: turn me on, dead man

Source: MITRE
Type: CNA
CVE-1999-0307

Source: MITRE
Type: CNA
CVE-1999-0336

Source: CCN
Type: Hewlett-Packard Support Web site
support

Source: XF
Type: UNKNOWN
hpux-mstm-bo(1439)

Source: MISC
Type: UNKNOWN
https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0336

Vulnerable Configuration:

Configuration 1:

cpe:/o:hp:hp-ux:10:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:hp:hp-ux:10.00:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.09:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.01:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.10:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.20:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.30:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.16:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.01:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.24:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.26:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.02:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.03:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.08:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:10.34:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.00:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.03:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.04:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.05:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.06:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.07:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.08:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.09:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:9.10:*:*:*:*:*:*:*

Denotes that component is vulnerable

Vulnerability Name:

CVE-1999-0336 (CCN-1440)

Assigned:

1996-11-01

Published:

1996-11-01

Updated:

1996-11-01

Summary:

The cstm program in HP-UX is vulnerable to a buffer overflow. A local attacker can overflow a buffer to gain root privileges.

CVSS v3 Severity:

9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete