NETarchitect is an application for simplifying the task of designing and deploying complex switched network system configurations, produced by Nortel Networks and usually shipped with the Optivity Network Configuration System suite of utilities. This product is vulnerable to a root compromise on an HP-UX (possibly Solaris as well) system running NETarchitect by exploiting a path vulnerability in the binary /opt/bna/bin/bna_pass. bna_pass executes 'rm' assuming that the end user's PATH value is valid and the real rm binary is in the one being called. Because of this, it is possible to have bna_pass execute arbitrary binaries as root if the PATH variable is manipulated. A malicious user can add "." to his PATH environment variable and have binaries searched for and executed. A false 'rm' would then be executed, compromising the system.
Credit:
The information was provided by: Loneguard.
