Furthermore, if a program is not required at your site, then all execute permissions should be removed. For example, the functionality provided by the chfn program is not needed by many sites since the user information stored in the password file, which chfn is used to change, is typically static. If sites had previously disabled the chfn program, they would not have been vulnerable to this latest exploit. The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible.
Vulnerabilities exists allowing local users to gain root privileges.
All patches are available now. The vulnerability can be eliminated from HP-UX releases 9.X and 10.X by applying the appropriate patch. C. Recommended solution 1. Determine which patch are appropriate for your operating system. The users guide explains the HP-UX patch downloading process via email and other services available.