CVE:CVE-2000-0844
CNNVD:CNNVD-200011-069
HP－UX 中的很多程序都使用libc库中的catopen()/catgets()等函数来显示本地化的信息。catopen()函数在检测到NLSPATH环境变量之后，会打开其指定的文件并从中读取消息。
然而，catopen()函数并没有对suid root程序使用NLSPATH变量进行限制，这允许本地攻击者通过设置NLSPATH变量指定自己构造的locale文件，当suid root程序将使用catopen()打开该消息文件并将其中的数据传递给*printf()函数时，就可能造成格式串漏洞。
任何使用catopen()/catgets()函数的suid root程序都可能受此漏洞影响，本地攻击者可以利用此漏洞获取root权限。
根据我们的测试，至少如下程序是受影响的:
-r-sr-xr-x   1 root       bin          45056 Nov 14  2000 /usr/bin/at
-r-sr-xr-x   1 root       bin          24576 Nov 14  2000 /usr/bin/crontab
-r-sr-xr-x   1 root       bin          45056 Nov 14  2000 /usr/bin/ct
-r-sr-xr-x   1 root       bin          36864 Apr 19  2001 /usr/bin/cu
-r-sr-xr-x   1 root       bin          20480 Nov 14  2000 /usr/lbin/exrecover
-r-sr-xr-x   1 root       bin          40960 Aug 16  2001 /usr/bin/lp
-r-sr-sr-x   2 root       mail         45056 Nov 14  2000 /usr/bin/mail
-r-sr-xr-x   5 root       bin          45056 Nov 14  2000 /usr/bin/passwd
-r-sr-xr-x   1 root       bin          24576 Nov 14  2000 /usr/bin/su
-r-sr-xr-x  11 root       bin        1921024 Nov  6  2001 /usr/sbin/swinstall
-r-sr-xr-x   2 root       bin        1028096 Nov  6  2001 /usr/sbin/swpackage
solution:Upgrade caldera openlinux_ebuilder to a higher version than 3.0,and avoid the version 3.0; Upgrade immunix immunix to a higher version than 6.2,and avoid the version 6.2; Upgrade conectiva linux to a higher version than 4.0,4.0es,4.1,4.2,5.0,5.1,and avoid the version 4.0,4.0es,4.1,4.2,5.0,5.1; Upgrade sgi irix to a higher version than 6.2,6.3,6.4,6.5,6.5.1,6.5.2m,6.5.3,6.5.3f,6.5.3m,6.5.4,6.5.6,6.5.7,6.5.8,and avoid the version 6.2,6.3,6.4,6.5,6.5.1,6.5.2m,6.5.3,6.5.3f,6.5.3m,6.5.4,6.5.6,6.5.7,6.5.8; Upgrade caldera openlinux to a higher version than *; Upgrade caldera openlinux_eserver to a higher version than 2.3,and avoid the version 2.3; Upgrade debian debian_linux to a higher version than 2.0,2.1,2.2,2.3,and avoid the version 2.0,2.1,2.2,2.3; Upgrade ibm aix to a higher version than 3.2,3.2.4,3.2.5,4.0,4.1,4.1.1,4.1.2,4.1.3,4.1.4,4.1.5,4.2,4.2.1,4.3,4.3.1,4.3.2,and avoid the version 3.2,3.2.4,3.2.5,4.0,4.1,4.1.1,4.1.2,4.1.3,4.1.4,4.1.5,4.2,4.2.1,4.3,4.3.1,4.3.2; Upgrade mandrakesoft mandrake_linux to a higher version than 7.0,7.1,and avoid the version 7.0,7.1; Upgrade redhat linux to a higher version than 5.0,5.1,5.2,6.0,6.1,6.2,and avoid the version 5.0,5.1,5.2,6.0,6.1,6.2; Upgrade slackware slackware_linux to a higher version than 7.0,7.1,and avoid the version 7.0,7.1; Upgrade sun solaris to a higher version than 2.6,and avoid the version 2.6; Upgrade sun sunos to a higher version than 5.0,5.1,5.2,5.3,5.4,5.5,5.5.1,5.7,5.8,and avoid the version 5.0,5.1,5.2,5.3,5.4,5.5,5.5.1,5.7,5.8; Upgrade suse suse_linux to a higher version than 6.1,6.2,6.3,6.4,7.0,and avoid the version 6.1,6.2,6.3,6.4,7.0; Upgrade trustix secure_linux to a higher version than 1.0,1.1,and avoid the version 1.0,1.1; Upgrade turbolinux turbolinux to a higher version than 6.0,6.0.1,6.0.2,6.0.3,6.0.4,and avoid the version 6.0,6.0.1,6.0.2,6.0.3,6.0.4