HP-UX PHNE_44235 : s700_800 11.11 NTP timeservices upgrade plus utilities

high Nessus Plugin ID 82682
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote HP-UX host is missing a security-related patch.

Description

s700_800 11.11 NTP timeservices upgrade plus utilities :

Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to execute code, create a Denial of Service (DoS), or other vulnerabilities. References:
CVE-2014-9293 - Insufficient Entropy in Pseudo-Random Number Generator (PRNG) (CWE-332) CVE-2014-9294 - Use of Cryptographically Weak PRNG (CWE-338) CVE-2014-9295 - Stack Buffer Overflow (CWE-121) CVE-2014-9296 - Error Conditions, Return Values, Status Codes (CWE-389) CVE-2014-9297 - Improper Check for Unusual or Exceptional Conditions (CWE-754) SSRT101872 VU#852879.

Solution

Install patch PHNE_44235 or subsequent.

See Also

http://www.nessus.org/u?1d544704

https://www.tenable.com/security/research/tra-2015-04

Plugin Details

Severity: High

ID: 82682

File Name: hpux_PHNE_44235.nasl

Version: 1.10

Type: local

Published: 4/10/2015

Updated: 1/11/2021

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:hp:hp-ux

Required KB Items: Host/local_checks_enabled, Host/HP-UX/version, Host/HP-UX/swlist

Exploit Ease: No known exploits are available

Patch Publication Date: 4/1/2015

Reference Information

CVE: CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, CVE-2014-9296, CVE-2014-9297

BID: 71757, 71758, 71761, 71762, 72583

CERT: 852879

HP: emr_na-c04554677

TRA: TRA-2015-04