hppatchs.txt Summary of HP Security Bulletins Document This document is current as of January 18, 1995. CIAC has compiled a summary of all security related patches currently available from Hewlett Packard. The patches are presented first in a table format, then a summary of the vulnerability information is presented for each patch in the order in which the HP Bulletins were distributed. This document is an update to CIAC Bulletin F-02 "Summary of HP Security Bulletins". Information about retrieving HP patches can be found in the abovementioned CIAC Bulletin. IMPORTANT NOTE: Hewlett Packard updates patches periodically. These updates are not reflected in the text of each HP bulletin. The overview presented here contains current information on the patches available at the time of the release of this CIAC bulletin. If you request an updated patch, when you try to retrieve the patch you will receive a message stating that the patch is obsolete and the name of the patch which supersedes it. The updates presented in this document may not reflect security updates to the patches. If a patch you have previously installed has been updated in the list below, retrieve the README for the patch to determine if your installation has a need to install the updated patch. Update history of this document: January 20, 1995: Fixed an incorrect patch name in the list of patches for HPSBUX9409-017, from PHSS_5037 to the correct PHSS_4863 January 18, 1995: Inclusion of information contained in CIAC Bulletin F-07, which includes HP Bulletin HPSBUX9411-019 and the updated HPSBUX9409-017. Updated patches from other HP Bulletins are indicated with a "%". _____________________________________________________________________________ CIAC wishes to thank Hewlett Packard for helping CIAC construct this summary. _____________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy. Services are available free of charge to DOE and DOE contractors. ------------------- A - T - T - E - N - T - I - O - N --------------------- For emergencies and off-hour assistance, DOE and DOE contractor sites can contact CIAC 24-hours a day via an integrated voicemail and SKYPAGE number. To use this service, dial 1-510-422-8193 or 1-800-759-7243 (SKYPAGE). The primary SKYPAGE PIN number, 8550070 is for the CIAC duty person. A second PIN, 8550074 is for the CIAC Project Leader. CIAC's FAX number is 510-423-8002, and the STU-III number is 510-423-2604. Send E-mail to ciac@llnl.gov. --------------------------------------------------------------------------- _____________________________________________________________________________ This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government nor the University of California, and shall not be used for advertising or product endorsement purposes. Appendix 1: Table of HP Security Bulletins * HP Progs Patches to Overview of Bulletin Affected Platform Install Vulnerability 9311-001 sendmail HP 9000 300,400,700,800 1 of 4 patches A mail message HP-UX 8.x, 9.x dependent on can cause configuration system commands to be executed 9312-002 Xterm HP 9000 300,400,700,800 1 of 5 patches The logging HP-UX 8.x, 9.x dependent on function of configuration xterm allows local users to create or modify files 9402-003 /etc/ HP 9000 300,400,700,800 1 of 2 patches /etc/ subnetconfig HP-UX 9.0/9.1 dependent on subnetconfig configuration can allow users to increase their privileges 9402-004 /dev/nit HP 9000 300,400,700,800 Evaluate Be aware of HP-UX Apollo Token Ring necessity of vulnerabilities or STREAMS-DLPI having the inherent in the machine on a nature of a network networked machine 9402-005 hpterm HP 9000 300,400,700,800 1 or 2 patches Users can gain hpterm Revision 2.89 or dependent on access to files earlier configuration; regardless of or use hpterm file ownership Rev 2.90/higher and permissions 9402-006 HP DCE HP 9000 series 700,800 1 patch Unauthorized Camera at revision 9.x root access 9404-007 Advisory none none Announcement only that HP is not vulnerable to the SITE EXEC problem 9404-008 HP Vue 3.0 HP 9000 300,400,700,800 1 of 2 patches Unauthorized HP-UX 9.x dependent on root access configuration 9405-009 OSF/AES HP 9000 series 700, Install 2 Root grants standard HP-UX 9.01 or 9.03 patches improper ownership of files and directories 9405-010 ftpd home All HP-UX systems root should Anonymous users directory own ftp home can change directory permissions on files 9405-011 HP HP 9000 series 300/400, 1 patch or Non-root users GlancePlus 700/800 update product can use glance rev B.09.00 for HP-UX 9.x or gpm to gain and earlier or use root privs workaround in HP-UX 8.x 9405-012 Multimedia HP 9000 series 700 at change file files were SUID Sharedprint HP-UX rev 9.x permissions on three files 9406-013 /usr/etc/vhe HP 9000 300,400,700,800 1 of 2 patches Unauthorized /vhe_u_mnt HP-UX 8.x, 9.x dependent on root access configuration 9406-014 Permissions All HP-UX systems Script for Patch files may of patches patches have become installed obtained before corrupted before June 21, 1994 6/21/94 9407-015 Xauthority HP 9000 series 700 Install 1 patch Unauthorized access to the display 9408-016 Advisory All HP-UX systems none HP patch 9408-000 only checksums and HP security bulletin checksums 9409-017 System HP 9000 700,800 Install Users can Message HP-UX 8.x, 9.x appropriate increase their catalog patch(es) privileges (fileset dependent upon CORE-DIAG) configuration 9410-018 xwcreate and HP 9000 300,400,700,800 Install 1 patch Files not owned gwind HP-UX 8.x, 9.x by a user can be removed by non-root users 9411-019 Support HP 9000 700,800 PHSS_4874 Users can Watch HP-UX 8.0, 8.02, potentially 8.06, and 9.0 only increase access privileges. * All HP-UX bulletins have the prefix HPSBUX, for example bulletin 9311-001 would be requested from HP as HPSBUX9311-001. Appendix II: Details of each HP Bulletin After every patch is installed, be sure to examine /tmp/update.log for any relevant WARNINGs or ERRORs. This can be done by typing "tail -60 /tmp/update.log | more", then paging through the next three screens via the space bar, looking for WARNING or ERROR messages. ================================================== HPSBUX9311-001: Sendmail, dated November 12, 1993 The patch to install depends on which operating system version and series you are currently using. Use the following chart to determine which patch to retrieve and install in /tmp: Operating Series Apply patch System HP-UX 8.x 300/400 PHNE_3995 HP-UX 9.x 300/400 PHNE_3996 HP-UX 8.x 700/800 PHNE_3371 HP-UX 9.x 700/800 PHNE_4936 % No patches will be available for releases of HP-UX prior to 8.0. If you are running a version prior to 8.0, modify the sendmail configuration file /usr/lib/sendmail.cf to disable the "prog" mailer function. Directions are found in HP Bulletin HPSBUX9311-001. To apply the sendmail patch: a. Follow the installation instructions included with the patch. The update process kills the running sendmail, replaces the /usr/lib/sendmail binary, and starts the new sendmail. If you do not have a frozen configuration file (/usr/lib/sendmail.fc), skip steps b, c, and d. If you do use a frozen configuration file, continue with step b. b. Kill the running sendmail by typing: "/usr/lib/sendmail -bk" c. Freeze the configuration file by typing: "/etc/freeze" d. Restart the sendmail daemon by typing: "/usr/lib/sendmail -bd -q30m" ================================================== HPSBUX9312-002: Xterm, dated November 30, 1993 (revised December 1, 1993) The patch to install depends on which operating system version and series you are currently using. Use the following chart to determine which patch to retrieve and install in /tmp: Operating Series Apply patch System HP-UX 9.x 700/800 PHSS_4996 % HP-UX 8.x 700 PHSS_3538 HP-UX 8.x 800 PHSS_4218 HP-UX 9.x 300/400 PHSS_5031 % HP-UX 8.x 300/400 PHSS_4216 No patches will be available for releases of HP-UX prior to 8.0. If you are running a version prior to 8.0, a workaround can be accomplished by removing the setuid permissions from xterm. This workaround introduces other problems, however, and the main recommendation is that the system be upgraded to a supported version of the operating system. To install the patch, retrieve the patch and apply it per the installation instructions included with the patch. ================================================== HPSBUX9402-003: /etc/subnetconfig, dated February 7, 1994 The patch to install depends on which operating system version and series you are currently using. The vulnerability only exists in HP-UX version 9.0 and 9.01 and has been fixed in 9.03. Use the following chart to determine which patch to retrieve and install in /tmp: Operating Series Apply patch System HP-UX 9.0, 9.01 700/800 PHNE_3564 HP-UX 9.0 300/400 PHNE_3563 To install the patch, retrieve the patch and apply it per the installation instructions included with the patch. ================================================== HPSBUX9402-004: /dev/nit, dated February 10, 1994 This bulletin did not announce a patch, but noted a vulnerability inherent in networked machines. The following was taken directly from HPSBUX9402-004: Essentially, the security vulnerability lies in ANY HP SYSTEM THAT MAKES NETWORK CONNECTIONS across networks where hosts exist that have an intruder who has gained root access and is using a network monitoring tool on a promiscuous mode of a lan interface. The intruder can then gain information about the HP systems which are using the network for a connection. HP supports the promiscuous mode on two products: Apollo Token Ring and STREAMS- DLPI. These programs allow a root user to access the promiscuous mode and can therefore be used by an INTRUDER WHO HAS ALREADY GAINED ROOT ACCESS on the HP system, to learn about OTHER systems which are using the network. Systems with the Apollo Token Ring and STREAMS-DLPI are NO MORE VULNERABLE than any other systems; they just allow intruders that have already cracked the system, by some other means, to EXTEND the intrusion to other systems using the attached network. ================================================== HPSBUX9402-005: hpterm, dated February 22, 1994 The patch to install depends on which operating system and series you are currently using. Use the following chart to determine which patch to retrieve and install in /tmp: Operating Series Apply patch(es) System HP-UX 9.X 700/800 PHSS_4995 % PHSS_4994 % HP-UX 9.X 300/400 PHSS_4527 PHSS_5027 % HP-UX 8.X 700 PHSS_4525 HP-UX 8.X 800 PHSS_4526 HP-UX 8.X 300/400 PHSS_4524 ================================================== HPSBUX9402-006: HP DCE/9000 Camera, dated February 24, 1994 The vulnerability exists only in the Camera component of HP DCE/9000, in versions 1.1 and 1.2 of HP DCE/9000 and the associated HP DCE Developers' Environment used with HP-UX version 9.X. Obtain patch PHSS_3820, install it per the installation instructions included with the patch. ================================================== HPSBUX9404-007: Advisory on ftpd SITE EXEC, dated April 22, 1994 HP distributed this Advisory to inform their users that their product line was and is NOT vulnerable to a certain security vulnerability within the UNIX operating system. ================================================== HPSBUX9404-008: HP Vue 3.0 dated April 19, 1994 The patch to install depends on which operating system version and series you are currently using. The vulnerability only exists in HP-UX version 9.X. CIAC issued CIAC Bulletin E-23 on this vulnerability. Use the following chart to determine which patch to retrieve and install in /tmp: Series Apply patch 700/800 PHSS_4994 % 300/400 PHSS_5027 % To install the patch, retrieve the patch and apply it per the installation instructions included with the patch. Note that this patch is the same patch as in HP Bulletin HPSBUX9402-005 above. Only one installation of this patch is necessary. ================================================== HPSBUX9405-009: OSF/AES standard, dated May 5, 1994 The vulnerability only exists on HP 9000 series 700 computers running HP-UX 9.01 or 9.03. Initially, the program cpio had been patched to work around the problem. Since this bulletin announces patches that remedy the problem, the workaround to cpio will be superseded via the installation of this cpio patch. Patch name Operating Series Apply patch(es) System OSF/AES patch HP-UX 9.01 700 PHKL_4968 % OSF/AES patch HP-UX 9.03, 9.05 700 PHKL_5165 % cpio patch HP-UX 9.X 700 PHCO_3533 Obtain necessary patches, install per the installation instructions included with the patches. ================================================== HPSBUX9405-010: ftpd race condition and ftpd home directory, dated May 4, 1994 This Advisory was distributed by HP to address a security issue with ftpd which was pertinent to many versions of UNIX. HP distributed this Advisory to inform their users that their product line was and is NOT vulnerable to a certain security vulnerability within ftpd involving a race condition. Secondly, HPSBUX9405-010 addressed an ftpd configuration problem. This issue is that the man page regarding ftpd recommends an insecure configuration for the permissions on the ftp home directory. The correct recommendation is that the ftp home directory should be owned by root. ================================================== HPSBUX9405-011: HP GlancePlus, dated May 4, 1994 This vulnerability exists in product executables on all versions of HP-UX for HP GlancePlus product revision B.09.00 and earlier for series 700/800 systems and in the /usr/perf/bin/glance program up to and including revision A.09.06 for series 300/400 systems. The GlancePlus version can be determined on 9.X systems by using the "what" command. The fix is to update to the next version of GlancePlus, which is version B.09.01 on series 700/800 computers and A.09.07 on series 300/400 machines. No patch will be available for HP-UX 8.X. If you have an 8.X system, the workaround is to change the permissions to 744 for the files /usr/bin/ruxux/glance. ================================================== HPSBUX9405-012: Multimedia Sharedprint, dated May 4, 1994 The vulnerability only exists on HP 9000 series 700 computers running HP-UX 9.X. To fix the problem perform the following three commands as root: chmod 544 /usr/imaging/pcl/util/update_pcl_fonts chmod 544 /usr/imaging/pcl/util/ssmak chmod 544 /usr/imaging/pcl/util/ixmak ================================================== HPSBUX9406-013: /usr/etc/vhe/vhe_u_mnt, dated June 21, 1994 (Revised July 5, 1994) The patch to install depends on which operating system version and series you are currently using. Use the following chart to determine which patch to retrieve and install in /tmp: Operating Series Apply patch System HP-UX 8.x, 9.x 700/800 PHNE_4434 HP-UX 8.x, 9.x 300/400 PHNE_4363 Obtain necessary patches, install per the installation instructions included with the patches. ================================================== HPSBUX9406-014: Patch permissions, dated July 5, 1994 This bulletin describes file permission problems with patches retrieved and installed prior to the date of this bulletin. The permissions to these patches were set to vulnerable values. All patches from June 21, 1994 on will have the correct file permission values. If you have retrieved and installed patches prior to the date of HP Bulletin HPSBUX9406-014, then HP recommends that all patch directories in /system should be examined. This process can be simplified by retrieving HP Bulletin HPSBUX9406-014 and executing the three scripts supplied with that bulletin. If you are retrieving patches after June 21, 1994, the patches have all had their permissions set correctly, and no action need to be taken in response to this bulletin. ================================================== HPSBUX9407-015: Xauthority problem, dated July 13, 1994 The vulnerability only exists in HP 9000 series 700 computers, using HP-UX version 9.X. Under certain conditions Xauthority will not be enabled, which can allow users logged into the X server's system to access the display without providing the Xauthority code. Obtain patch PHSS_5066 % and install it per the installation instructions included with the patch. ================================================== HPSBUX9408-016: Patch Checksums dated August 29, 1994, and HPSBUX9408-000: dated August 31, 1994 (Revised October 12, 1994) HPSBUX9408-016 was the first HP advisory to announce the availability of checksum s for all previous HP patches, whether or not the patches relate to security vulnerabilities. HPSBUX9408-016 also contains source to the MD5 checksum utility, as well as a script entitled check_patch which performs the checking of patches. As more patches were released, HP decided to include the checksums for the HP security bulletins; these bulletin checksums are contained in HPSBUX9408-000. To obtain the MD5 program, following these steps: 1. Obtain HP Advisory HPSBUX9408-016 from HP by using the information contained on the first page of this CIAC Bulletin. 2. Extract the MD5 shar file from HPSBUX9408-016 and place it into the file md5.shar. 3. Unpack the source by typing sh md5.shar 4, Make and test the md5 program by typing make test. You will see the following output: cc -c -O -DMD=5 md5c.c cc -c -O -DMD=5 mddriver.c cc -o md5 md5c.o mddriver.o ./md5 -x | diff - test.rfc > diffs 2>&1 *** MD5 Test Passed rm -f diffs 5. Extract the check_patch script from HPSBUX9408-016. This script unpacks a patch, computes the sums, and finds any matches in the hp-ux_patch_sums file. The script assumes that the patch and the hp-ux_patch_sums file are both in the working directory. It also assumes that md5 is installed and can be reached via $PATH. There are three ways to retrieve the current list of checksums for the patches themselves. They can be retrieved via WWW by connecting to HP's WWW server at http://support.mayfield.hp.com. To receive the list by email, send the words "send hp-ux_patch_sums" in the text portion of the message to support@support.mayfield.hp.com. This is the same method used as in the first page of this CIAC bulletin. The third, quickest method of retrieving the current list of checksums is to retrieve them via FTP from support.mayfield.hp.com (IP address 192.6.148.1) from the file ~/export/patches/hp-ux_patch_sums. Note that this is NOT available via ANONYMOUS FTP. Detailed directions for FTP access and self- registration of an account on support.mayfield.hp.com are included in HPSBUX9408-016. ================================================== HPSBUX9409-017: CORE-DIAG vulnerability, dated September 21, 1994 (Revised October 18, 1994, then revised December 1, 1994) This vulnerability can allow a user to increase their access privileges. The vulnerability exists for all HP-UX systems using the CORE-DIAG fileset. No patches will be available for versions of HP_UX prior to version 8.0. The patch to install depends on which operating system version and series you are currently using. To determine the operating system version of your system, display the file /system/UX-CORE/index with the "more" or "pg" command. The line will look similar to: fv: A.BX.YY.ZZ Where X is the major revision, YY is the minor revision, and ZZ is the PCO index. For example, if your system needed to install an item on the chart below, (HP-UX 9.00.4A) the major revision would be "9", the minor revision would be "00" and the PCO index would be "4A". Note that these patches are quite large. Use the following chart to determine which patch to retrieve and install in /tmp: Operating System Series Apply patch HP-UX 8.0, 8.06 800 PHSS_4578 HP-UX 8.02 800 PHSS_4577 HP-UX 8.05, 8.07 700 PHSS_4574 HP-UX 9.00.2O or 9.00.3A 800 PHSS_4532 HP-UX 9.00.4A 800 PHSS_4660 HP-UX 9.01 700 PHSS_4475 HP-UX 9.03, 9.05 700 PHSS_4863 % HP-UX 9.04 800 PHSS_4913 Obtain necessary patches, install per the installation instructions included with the patches. ================================================== HPSBUX9410-018: xwcreate and gwind, dated October 12, 1994 The program /usr/bin/X11/xwcreate is used to create X windows and devices files for raw-mode Starbase applications to display into. The xwcreate program invokes /usr/bin/X11/gwind which creates the device file. It is possible that existing files not owned by the user may be removed by using this software. The patch to install depends on which operating system version and series you are currently using. Use the following chart to determine which patch to retrieve and install in /tmp: Operating Series Apply patch System HP-UX 9.x 700/800 PHSS_5140 HP-UX 8.x 700 PHSS_4834 HP-UX 8.x 800 PHSS_4835 HP-UX 9.x 300/400 PHSS_4833 HP-UX 8.x 300/400 PHSS_4836 Obtain necessary patches, install per the installation instructions included with the patches. ================================================== HPSBUX9411-019: Support Watch, dated November 30, 1994 This vulnerability, which can allow users to increase their access privileges, exists ONLY in HP 9000 series 800 running HP-UX revisions 8.0, 8.02, 8.06 and 9.0. Later HP-UX releases including 9.04 are NOT affected by this vulnerability. Obtain patch PHSS_4874, install it per the installation instructions included with the patch. ================================================== HPSBUX9510-020: HP-UX Remote Watch, dated January 31, 1995 This vulnerability can allow users to increase their access privileges which may result in system compromise. All HP 300/400 and 700/800 series machines running HP-UX 8.x or 9.x which have Remote Watch installed are affected. The patch to install depends on which operating system version and machine series you are currently using. Use the following table to determine which patch to retrieve and install: Operating System Series Apply patch HP-UX 8.x 800 PHSS_5185 HP-UX 9.x 800 PHSS_5136 HP-UX 8.x 700 PHSS_5180 HP-UX 9.x 700 PHSS_5107 HP-UX 8.x 300/400 PHSS_5168 HP-UX 9.x 300/400 PHSS_5120 Obtain necessary patches, and install per the installation instructions included with the patches. After the patch is installed, be sure to examine /tmp/update.log for any relevant WARNINGs or ERRORs. This can be done by typing "tail -60 /tmp/update.log | more", then paging through the screens via the space bar, looking for WARNING or ERROR messages. ================================================== HPSBUX9502-021 /bin/mail security problem, dated February 1, 1995 Problem: /bin/mail security problem announced in CIAC F-09. Platform: All HP-UX systems Damage/Status: No current vulnerability in /bin/mail (or /bin/rmail) Solution: Continue to use /bin/mail distributed with HP-UX. Do NOT use mail.local A recent annoucement by CIAC (F-09) and CERT (CA-95:02) warned of a potential danger caused by the /bin/mail and advised users to run mail.local instead of /bin/mail. The mail.local program is primarily intended for those system which use /bin/mail directories that have 777 permissions. HP only supports /usr/mail directories that have 775 permissions: drwxrwxr-x 2 bin mail 1024 Jan 30 16:21 mail/ With such permissions, /bin/mail has no vulnerabilities. HP-UX users are recommended to continue to use the /bin/mail distributed with the release tapes or provided in official HP-UX patches. HP does NOT recommend the use of the mail.local program. ================================================== HPSBUX9502-022 HP-UX Malicious Code Sequences Document Id: [HPSBUX9502-022] Date Loaded: [02-15-95] Description: Security Vulnerability involving malicious users =============================================================================== ---------------------------------------------------------------------- HEWLETT-PACKARD SECURITY BULLETIN: #00022, 15 February 95 ---------------------------------------------------------------------- The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. ---------------------------------------------------------------------- PROBLEM: Security vulnerability involving malicious users PLATFORM: HP 9000 series 700 and series 800 at revisions 9.X DAMAGE: Users can gain unauthorized privileges SOLUTION: Apply the appropriate patch for your version of HP-UX For HP-UX 9.09+ (BLS), apply patch PHKL_5190, HP-UX 9.09 (BLS), apply patch PHKL_5191, HP-UX 9.08 (BLS), apply patch PHKL_5192, HP-UX 9.05, apply patch PHKL_5049, HP-UX 9.04, apply patch PHKL_5051, HP-UX 9.03, apply patch PHKL_5049, HP-UX 9.01, apply patch PHKL_5048, HP-UX 9.0 , apply patch PHKL_5050. AVAILABILITY: All patches are available now. ----------------------------------------------------------------------------- A. Problem Hewlett-Packard has discovered some malicious coding sequences that can cause the HP-UX Operating System to crash. These coding sequences are malicious in origin and not representative of compiler generated code. The resulting system crash is not always predictable, depending heavily on the state of the system at the time of the attack. Given this uncertainty, it is feasible that the security and/or integrity of the system might become compromised. Having identified this type of system vulnerability, HP has developed a patch that when installed provides the following countermeasures. First, it will protect your system from privilege violations that might be attempted using these malicious coding sequences. Secondly, it strengthens the Operating System so that it is more resistant to this type of attack. Should the attack succeed in crashing the system, this patch will in most cases report the identity of the process and user that executed the malicious coding sequences. System Administrators can use this identification information to help track down the source of such attacks on their system. B. What the Patch Does This patch replaces key HP-UX library routines C. How to Get The Patch For HP-UX BLS product patches PHKL_5190, PHKL_5191 & PHKL_5192 are NOT electronically available. For assistance in obtaining and installing this patch contact the HP Response Center at 1 (800) 633-3600. Be sure to mention the keyword "BLS" to help route the call. All the other patches are available electronically. You can retrieve a patch by using the service described below. D. How to Install The Patch 1. Determine which patch is appropriate for your hardware platform and operating system: On the BLS product, HP-UX 9.08 (series 800) & HP-UX 9.09 (series 700), execute: what /hp-ux . On commercial products HP-UX 9.X (series 800) & HP-UX 9.X (series 700), execute: what /hp-ux . Look for the product 9245XA (series 800) and B2352A (series 700) to identify the revision currently running. Then use the table above to select the appropriate patch to request or retrieve. 2. Hewlett Packard's HP-UX patches are available via email & WWW (MOSAIC) To obtain a copy of the HP SupportLine email service user's guide, send the following in the TEXT PORTION OF THE MESSAGE to support@support.mayfield.hp.com (no Subject is required): send guide The users guide explains the process for downloading HP-UX patches via email and other services available. WWW (MOSAIC) service (downloading of patches) is also available via WWW (MOSAIC) our URL is: (http://support.mayfield.hp.com) 3. Apply the patch to your HP-UX system. 4. Examine /tmp/update.log for any relevant WARNINGs or ERRORs. This can be done as follows: a. At the shell prompt, type "tail -60 /tmp/update.log | more" b. Page through the next three screens via the space bar, looking for WARNING or ERROR messages. E. Impact of the patch and workaround No patches will be available for versions of HP-UX prior to 9.0. ================================================== HPSBUX9502-023 HP-UX `at' and `cron' vulnerabilities Document Id: [HPSBUX9502-023] Date Loaded: [02-22-95] Description: Security vulnerability in `at' & `cron' =============================================================================== ------------------------------------------------------------------------- HEWLETT-PACKARD SECURITY BULLETIN: #00023, 22 Feb 95 ------------------------------------------------------------------------- The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett- Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. _______________________________________________________________________ PROBLEM: Security vulnerability in the `at' and `cron' command in HP-UX PLATFORM: HP 9000 series 300/400s and/or 700/800s DAMAGE: Users can gain unauthorized privileges SOLUTION: Apply patch PHCO_5203 (series 700 , HP-UX 8.X), or PHCO_5204 (series 800 , HP-UX 8.X), or PHCO_5199 (series 300/400, HP-UX 8.X), or PHCO_5178 (series 700 , HP-UX 9.X), or PHCO_5193 (series 800 , HP-UX 9.X), or PHCO_5206 (series 300/400, HP-UX 9.0), or PHCO_5206 (series 300/400, HP-UX 9.03). AVAILABILITY: All patches are available now. _______________________________________________________________________ I. Update A. It has been found that all HP-UX systems have this vulnerability. B. Fixing the problem The vulnerability can be eliminated from releases 8.X and 9.X of HP-UX by applying a patch. All customers concerned with the security of their HP-UX systems should apply the appropriate patch described above as soon as possible. C. How to Install the Patch (for HP-UX 8.X and 9.X) 1. Determine which patch is appropriate for your hardware platform and operating system: PHCO_5203 (series 700 , HP-UX 8.X), or PHCO_5204 (series 800 , HP-UX 8.X), or PHCO_5199 (series 300/400, HP-UX 8.X), or PHCO_5178 (series 700 , HP-UX 9.X), or PHCO_5193 (series 800 , HP-UX 9.X), or PHCO_5206 (series 300/400, HP-UX 9.0), or PHCO_5206 (series 300/400, HP-UX 9.03). 2. Hewlett Packard's HP-UX patches are available via email & WWW (MOSAIC). To obtain a copy of the HP SupportLine email service user's guide, send the following in the TEXT PORTION OF THE MESSAGE to support@support.mayfield.hp.com (no Subject is required): send guide The users guide explains the process for downloading HP-UX patches via email and other services available. WWW (MOSAIC) service (downloading of patches) is also available via WWW (MOSAIC) our URL is: (http://support.mayfield.hp.com) 3. Apply the patch to your HP-UX system. 4. Examine /tmp/update.log for any relevant WARNINGs or ERRORs. This can be done as follows: a. At the shell prompt, type "tail -60 /tmp/update.log | more" b. Page through the next three screens via the space bar, looking for WARNING or ERROR messages. D. Impact of the patch and workaround The patch for HP-UX releases 8.X and 9.X provides a new version of /etc/cron and /usr/bin/at which fixes the vulnerability. ================================================== HPSBUX9502-024 /usr/lib/sendmail has two security vulnerabilities Document Id: [HPSBUX9502-024] Date Loaded: [02-23-95] Description: /usr/lib/sendmail has two security vulnerabilities =============================================================================== ------------------------------------------------------------------------- HEWLETT-PACKARD SECURITY BULLETIN: #00024, 22 Feb 95 ------------------------------------------------------------------------- _______________________________________________________________________ PROBLEM: /usr/lib/sendmail has two security vulnerabilities PLATFORM: HP 9000 series 300/400s and 700/800s 8.x and 9.x DAMAGE: One vulnerability allows users to modify any file, the other permits non-local users to gain access to files. SOLUTION: Apply patch PHNE_5264 (series 700/800, HP-UX 9.x), or PHNE_5263 (series 700/800, HP-UX 8.x), or PHNE_5260 (series 300/400, HP-UX 9.0), or PHNE_5259 (series 300/400, HP-UX 8.x) AVAILABILITY: The s700/800 patches will be available 23 Feb 95. The s300/400 9.x patch will be available 24 Feb 95. The s300/400 8.x patch will be available 1 Mar 95. (Workaround available until that time.) _______________________________________________________________________ Hewlett-Packard recommends that the information in the following Security Bulletin should be acted upon as soon as possible. Hewlett- Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. I. Vulnerability in /usr/lib/sendmail A. Recent CERT advisory on sendmail A recent CERT advisory (CERT CA-95:05) described a vulnerability in /usr/lib/sendmail that would allow any existing user on a system to modify any file on the system. This vulnerability does not allow users without a local login to gain access to the system. (Queue file problem.) A previous CERT advisory (CERT CA-94:12) also described a vulnerability in sendmail which allows non-local users to gain access to files on the system. (-d debug problem) It has been found that all currently supported HP-UX systems have these two vulnerabilities. Another vulnerability mentioned in the CERT CA-95:05 advisory, the IDENT problem, is not a problem in any version of HP-UX sendmail. B. Fixing the problems The two vulnerabilities can be eliminated from releases 8.x and 9.x of HP-UX by applying a patch. Hewlett-Packard recommends that all customers concerned with the security of their HP-UX systems apply the appropriate patch as soon as possible. For the s300/400 8.x systems, a workaround is recommended until the patch mentioned below is available: s300/400 workarounds: --------------------- Vulnerability #1 - queue file problem Use sendmail.wrapper included in the CERT CA-95:05 bulletin. (Be sure to 'uninstall' sendmail.wrapper before installing the official PHNE_5259 patch!) Vulnerability #2 - debug option Install previous patch for sendmail: PHNE_3995 These workarounds should only be used until the PHNE_5259 patch is available. C. How to Install the Patch (for HP-UX 8.x and 9.x) 1. Determine which patch is appropriate for your hardware platform and operating system: Patch Available ------------------------------------- --------- PHNE_5264 (series 700/800, HP-UX 9.x), 2/23/95 PHNE_5263 (series 700/800, HP-UX 8.x), 2/23/95 PHNE_5260 (series 300/400, HP-UX 9.0), 2/24/95 PHNE_5259 (series 300/400, HP-UX 8.x) 3/1/95 2. Hewlett Packard's HP-UX patches are available via email and World Wide Web To obtain a copy of the HP SupportLine email service user's guide, send the following in the TEXT PORTION OF THE MESSAGE to support@support.mayfield.hp.com (no Subject is required): send guide The users guide explains the process for downloading HP-UX patches via email and other services available. World Wide Web service for downloading of patches is available via our URL: (http://support.mayfield.hp.com) 3. Apply the patch to your HP-UX system. 4. Examine /tmp/update.log for any relevant WARNINGs or ERRORs. This can be done as follows: a. At the shell prompt, type "tail -60 /tmp/update.log | more" b. Page through the next three screens via the space bar, looking for WARNING or ERROR messages. D. Impact of the patch and workaround The patch for HP-UX releases 8.x and 9.x provides a new version of /usr/lib/sendmail which fixes the vulnerability. No patches will be available for versions of HP-UX prior to 8.0. ____________________________________________________________________________