CVE-2007-0805 Information disclosure in n/a

Low 2.1 Published 7 Feb 2007 Updated 7 Aug 2024

Local users can read environment variables of arbitrary processes via the ps command, exposing sensitive information.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2007-0805?

CVE-2007-0805 is a low-severity vulnerability in n/a, published on 7 Feb 2007. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The ps (/usr/ucb/ps) command on HP Tru64 UNIX 5.1 1885 allows local users to obtain sensitive information, including environment variables of arbitrary processes, via the "auxewww" argument, a similar issue to CVE-1999-1587.

Which versions are affected by CVE-2007-0805?

It affects 1 product.

Products include Hp Tru64.

How do I fix CVE-2007-0805?

No fix has been published for CVE-2007-0805 yet. Limit exposure of the affected software until one is available.

Is CVE-2007-0805 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-0805 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-ccm4-xqqh-24h9.