HP Apollo SUID Exec Vulnerability

The HP Apollo Domain/OS sr10.2 and sr10.3 beta operating system contains a vulnerability in the /etc/suid_exec program, which is related to the Korn Shell (ksh). This allows an attacker to execute arbitrary code on the system by manipulating the suid bit on files. This vulnerability poses a significant risk, as it can be exploited locally without requiring authentication or special privileges.

You're affected if you use HP Apollo Domain/OS sr10.2 and sr10.3 beta. Check with: grep "suid_exec" /etc/passwd 2>/dev/null

Patch: Download the patch from http://www.cert.org/advisories/CA-1990-04.html.
- Immediate mitigations:
- Restrict access to the suid bit on files (e.g., set permissions to 755).
- Monitor for suspicious activity related to the suid bit.

• Patch
• www.ciac.org
• www.iss.net
• www.securityfocus.com
• Patch
• www.ciac.org
• www.iss.net
• www.securityfocus.com