HP has recently released information about fixes to vulnerabilities in expreserve, rpc.pcnfsd, and rpc.statd software. Read and implement the recommendations and patches described below. G-22 for more information on the rpc.statd vulnerability. Hewlett-Packard recommends that the information in the following Security Bulletin should be acted upon as soon as possible. Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible.
All patches are available now.
A. A private communication to HP described a vulnerability that allows ordinary users to potentially gain super-user privileges. If the patches mentioned above are applied the vulnerability cannot be exploited. In case no patches is available for your host HP-UX release, system administrators are asked to perform the following action to achieve the same result. The vulnerability can be eliminated from releases 9.X of HP-UX by applying a patch. The users guide explains the HP-UX patch downloading process via email and other services available.