HP-UX Ignite-UX Blank Password Field Vulnerability
In systems running HP-UX, the password field in
/etc/passwd contains a token character, "*". Under some
circumstances, this field can be set to empty -- leaving
the HP-UX system vulnerable to compromise. One such
circumstance which can cause this to occur is by
creating an image of a system with Ignite-UX, which does
not normally include the /etc/passwd file. When the
image is loaded on a system, the password file will be
left with blank entries.
In the advisory HP released regarding this
vulnerability, the following fix/workaround was
suggested:
Fixing the problem
In a trusted system if the system or the /etc/passwd
file has been restored, verify that the password fields
in /etc/passwd are "*". If Ignite-UX is used to create
an image of a trusted system, _override_the_default_ so
that /etc/passwd is saved in the image. See man(1M)
make_sys_image and note the -f file option. |
