CVE-2016-2016 Auth bypass in n/a
Local users can bypass access restrictions on HP-UX VxFS due to mishandled ACL inheritance, allowing unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-2016?
CVE-2016-2016 is a medium-severity authentication bypass vulnerability in n/a, published on 14 May 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Base-VxFS-50 B.05.00.01 through B.05.00.02, Base-VxFS-501 B.05.01.0 through B.05.01.03, and Base-VxFS-51 B.05.10.00 through B.05.10.02 on HPE HP-UX 11iv3 with VxFS 5.0, VxFS 5.0.1, and VxFS 5.1SP1 mishandles ACL inheritance for default:class: entries, default:other: entries, and default:user: entries, which allows local users to bypass intended access restrictions by leveraging the configuration of a parent directory.
Weakness: CWE-284
Which versions are affected by CVE-2016-2016?
It affects 3 products.
Products include Hp Base-Vxfs-50, Hp Base-Vxfs-501, Hp Base-Vxfs-51.
How do I fix CVE-2016-2016?
No fix has been published for CVE-2016-2016 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-2016 being exploited?
There is no known exploitation of CVE-2016-2016 in the wild and no public exploit code.
Sources
Also known as GHSA-9cfp-2g6x-m8f6.