Vulnerability Description
An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later. A malformed DCL command table may result in a buffer overflow allowing a local privilege escalation when a non-privileged account enters a crafted command line. This bug is exploitable on VAX and Alpha and may cause a process crash on IA64. Software was affected regardless of whether it was directly shipped by VMS Software, Inc. (VSI), HPE, HP, Compaq, or Digital Equipment Corporation.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hp | Openvms | <= 8.4-2l1 |
Related Weaknesses (CWE)
References
- http://www.openvms.org/node/121Vendor Advisory
- https://groups.google.com/forum/#%21topic/comp.os.vms/BYIUQ0lJ-s0
- https://www.theregister.co.uk/2018/02/06/openvms_vulnerability/Third Party Advisory
- http://www.openvms.org/node/121Vendor Advisory
- https://groups.google.com/forum/#%21topic/comp.os.vms/BYIUQ0lJ-s0
- https://www.theregister.co.uk/2018/02/06/openvms_vulnerability/Third Party Advisory
FAQ
What is CVE-2017-17482?
CVE-2017-17482 is a vulnerability with a CVSS score of 7.8 (HIGH). An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later. A malformed DCL command table may result in a buffer overflow allowing a local pri...
How severe is CVE-2017-17482?
CVE-2017-17482 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-17482?
Check the references section above for vendor advisories and patch information. Affected products include: Hp Openvms.