SB2024091072 - Remote denial of service in HPE HP-UX NFS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2024-42500)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in HPE HP-UX System's Network File System (NFSv4) services. A remote attacker can send specially crafted input to the system and perform a denial of service (DoS) attack.

2) Input validation error (CVE-ID: CVE-1999-0195)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in HPE HP-UX System's remote procedure call (RPC) services. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbux04697en_us&docLocale=en_US
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbux04685en_us