CVE-2003-1097

HP-UX B.10.20 B.11.00 B.11.04 - Local Privilege Escalation via rexec Long -l Option

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2003-1097. PoCs published by Davide Del Vecchio.

AI-analyzed exploit summary This exploit leverages a boundary condition error in the rexec program on HP-UX systems. By supplying an excessively long argument (9777 'A' characters), a local user can trigger a buffer overflow to gain elevated privileges.

Description

Buffer overflow in rexec on HP-UX B.10.20, B.11.00, and B.11.04, when setuid root, may allow local users to gain privileges via a long -l option.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Davide Del Vecchio · textdoshp-ux

https://www.exploit-db.com/exploits/22552

View Code ZIP pw:eip

This exploit leverages a boundary condition error in the rexec program on HP-UX systems. By supplying an excessively long argument (9777 'A' characters), a local user can trigger a buffer overflow to gain elevated privileges.

Classification

Working Poc 90%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: HP-UX rexec (versions affected by CVE-2003-1097)

No auth needed

Prerequisites: Local access to the HP-UX system · Presence of vulnerable rexec version

MITRE ATT&CK