Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   OS (UNIX)  >   HP-UX Vendors:   HPE
HP-UX Buffer Overflow in ldconn Lets Remote Users Gain Root Privileges
SecurityTracker Alert ID:  1018524
SecurityTracker URL:
CVE Reference:   CVE-2007-4241   (Links to External Site)
Updated:  Apr 21 2008
Original Entry Date:  Aug 7 2007
Impact:   Execution of arbitrary code via network, Root access via network
Vendor Confirmed:  Yes  
Version(s): 11.11, possibly other versions
Description:   A vulnerability was reported in HP-UX in ldconn. A remote user can execute arbitrary code on the target system.

A remote user can send specially crafted data to the ldcconn daemon on TCP port 17781 to trigger a buffer overflow and execute arbitrary code on the target system. The code will run with root privileges.

The vendor was notified on November 2, 2004.

iDefense Labs discovered this vulnerability.

Impact:   A remote user can execute arbitrary code with root privileges on the target system.
Solution:   No solution was available at the time of this entry.

The vendor indicates that the product is no longer supported and will not be patched.

Vendor URL: (Links to External Site)
Cause:   Boundary error

Message History:   None.

 Source Message Contents

Subject:  iDefense Security Advisory 08.07.07: Hewlett-Packard HP-UX Remote

Hewlett-Packard HP-UX Remote ldcconn Buffer Overflow Vulnerability

iDefense Security Advisory 08.07.07
Aug 07, 2007


Cisco Local Director is a load-balancing, connection fail-over device
used to help manage large enterprise networks. HP-UX allows for easy
interfacing with Cisco Local Director using the HP Controller for Cisco
Local Director package. In this package is ldcconn, which is configured
to run via inetd on TCP port 17781.


Remote exploitation of a buffer overflow vulnerability in ldcconn allows
attackers to execute arbitrary code with root privileges.

By sending a long string to the TCP port that ldcconn listens on, a
buffer overflow is triggered. No authentication or data validation is


Exploitation allows unauthenticated remote attackers to gain root access
on affected machines.

The seriousness of this vulnerability is increased by the fact that in
most cases an attacker will have unlimited attempts at successful
exploitation due to the fact that inetd will continue to launch the
service for each new connection.


iDefense confirmed the existence of this vulnerability in HP-UX 11.11i.
It is suspected that other versions are also vulnerable.

To determine if ldcconn is installed on your specific install, use the

  # swlist -l file | grep ldcconn

If this command returns anything, it means it is installed. To tell if
it is currently configured to run from inetd, use the command:

  # grep ldcconn /etc/inetd.conf

If it returns an entry, that means it is currently configured to run
from inetd.


Firewall rules should be set to only allow Cisco equipment to access the
service (port 17781).

If the service is not being used, simply remove, or comment out, the
entry in /etc/inetd.conf and restart inetd.


Hewlett-Packard states that this product is obsolete and no longer
supported. They have no plans to release a patch or advisory. They
further stated that the version of HP-UX used to verify this
vulnerability is also obsolete.

"HP simply recommends that customers upgrade to a currently supported OS
release and to some other tool, if one is available."


A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.


11/02/2004  Initial vendor notification
11/03/2004  Initial vendor response
12/19/2005  Second vendor notification
01/30/2007  Third vendor notification
01/30/2007  Third vendor response
04/25/2007  Status update requested
06/08/2007  Status update requested
07/24/2007  Status update requested
07/30/2007  Vendor stated product's support ended in 2002
08/06/2007  Vendor communicated their response
08/07/2007  Coordinated public disclosure


This vulnerability was discovered by iDefense Labs.

Get paid for vulnerability research

Free tools, research and upcoming events


Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
 There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
To unsubscribe, go here:


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, LLC