Subject Summary of security related HP patches Date 20-Jan-95
a1bb6bf2d160c5157039c276fdbfa3755777c4e1641d238ba897d61d2c922d10-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===============================================================================
>> CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl. Links <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>> <<
>> CERT-NL also has stopped the CERT-CC-Mirror service. Due to this the <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the <<
>> complete CERT-CC advisory texts: http://www.cert.org <<
===============================================================================
===============================================================================
Security Advisory CERT-NL
===============================================================================
Author/Source : Don Stikvoort Index : S-95-03
Distribution : World Page : 1
Classification: External Version: Final
Subject : Summary of security related HP patches Date : 20-Jan-95
===============================================================================
By courtesy of CIAC and Hewlett Packard we could obtain the following
summary of security related HP patches. It is a revised and slightly
enhanced version of an original CIAC document.
This summary INCLUDES the patches mentioned in S-95-02 : New and Revised
HP Bulletins.
How to get other CERT-NL advisories and how to contact us, you will find
at the very bottom of this document.
===============================================================================
Summary of HP Security Bulletins Document
This document is current as of January 18, 1995.
CIAC has compiled a summary of all security related patches currently
available from Hewlett Packard. The patches are presented first in a
table format, then a summary of the vulnerability information is presented
for each patch in the order in which the HP Bulletins were distributed.
HP has set up an automatic server to allow patches and other security
information to be retrieved over the Internet. To utilize this server,
send a message to support@support.mayfield.hp.com. The subject line of the
message will be ignored. The body (text) of the message should contain the
words
send XXXX
where XXXX is the identifier for the information you want retrieved. For
example, to retrieve the patch PHSS_4834, the message would be "send
PHSS_4834".
Other information that can be retrieved include the HP SupportLine mail
service user's guide (send guide.txt), the readme file for a patch (send
doc PHSS_4834), and the original HP bulletin (send doc HPSBUX9410-018).
HP also has a World Wide Web server to browse and retrieve bulletins and
patches. To utilize this server, use a WWW client and connect to
http://support.mayfield.hp.com.
IMPORTANT NOTE: Hewlett Packard updates patches periodically. These
updates are not reflected in the text of each HP bulletin. The overview
presented here contains current information on the patches available at
the time of the release of this CIAC bulletin. If you request an updated
patch, when you try to retrieve the patch you will receive a message
stating that the patch is obsolete and the name of the patch which
supersedes it.
The updates presented in this document may not always reflect SECURITY
updates to the patches. If a patch you have previously installed has been
updated in the list below, retrieve the README for the patch to determine
if your installation has a need to install the updated patch.
Hewlett Packard has made sum and MD5 checksums available for their patches
and for their security bulletins. Information on how to access and utilize
these checksums is mentioned below in the description of patch
HPSBUX9408-016.
CIAC wishes to thank Hewlett Packard for helping CIAC construct this summary.
- -----------------------------------------------------------------------------
Appendix 1: Table of HP Security Bulletins
* HP Progs Patches to Overview of
Bulletin Affected Platform Install Vulnerability
9311-001 sendmail HP 9000 300,400,700,800 1 of 4 patches A mail message
HP-UX 8.x, 9.x dependent on can cause
configuration system commands
to be executed
9312-002 Xterm HP 9000 300,400,700,800 1 of 5 patches The logging
HP-UX 8.x, 9.x dependent on function of
configuration xterm allows
local users to
create or
modify files
9402-003 /etc/ HP 9000 300,400,700,800 1 of 2 patches /etc/
subnetconfig HP-UX 9.0/9.1 dependent on subnetconfig
configuration can allow users
to increase
their
privileges
9402-004 /dev/nit HP 9000 300,400,700,800 Evaluate Be aware of
HP-UX Apollo Token Ring necessity of vulnerabilities
or STREAMS-DLPI having the inherent in the
machine on a nature of a
network networked
machine
9402-005 hpterm HP 9000 300,400,700,800 1 or 2 patches Users can gain
hpterm Revision 2.89 or dependent on access to files
earlier configuration; regardless of
or use hpterm file ownership
Rev 2.90/higher and permissions
9402-006 HP DCE HP 9000 series 700,800 1 patch Unauthorized
Camera at revision 9.x root access
9404-007 Advisory none none Announcement
only that HP is not
vulnerable
to the SITE
EXEC problem
9404-008 HP Vue 3.0 HP 9000 300,400,700,800 1 of 2 patches Unauthorized
HP-UX 9.x dependent on root access
configuration
9405-009 OSF/AES HP 9000 series 700, Install 2 Root grants
standard HP-UX 9.01 or 9.03 patches improper
ownership of
files and
directories
9405-010 ftpd home All HP-UX systems root should Anonymous users
directory own ftp home can change
directory permissions on
files
9405-011 HP HP 9000 series 300/400, 1 patch or Non-root users
GlancePlus 700/800 update product can use glance
rev B.09.00 for HP-UX 9.x or gpm to gain
and earlier or use root privs
workaround in
HP-UX 8.x
9405-012 Multimedia HP 9000 series 700 at change file files were SUID
Sharedprint HP-UX rev 9.x permissions on
three files
9406-013 /usr/etc/vhe HP 9000 300,400,700,800 1 of 2 patches Unauthorized
/vhe_u_mnt HP-UX 8.x, 9.x dependent on root access
configuration
9406-014 Permissions All HP-UX systems Script for Patch files may
of patches patches have become
installed obtained before corrupted
before June 21, 1994
6/21/94
9407-015 Xauthority HP 9000 series 700 Install 1 patch Unauthorized
access to the
display
9408-016 Advisory All HP-UX systems none HP patch
9408-000 only checksums and
HP security
bulletin
checksums
9409-017 System HP 9000 700,800 Install Users can
Message HP-UX 8.x, 9.x appropriate increase their
catalog patch(es) privileges
(fileset dependent upon
CORE-DIAG) configuration
9410-018 xwcreate and HP 9000 300,400,700,800 Install 1 patch Files not owned
gwind HP-UX 8.x, 9.x by a user can
be removed by
non-root users
9411-019 Support HP 9000 700,800 PHSS_4874 Users can
Watch HP-UX 8.0, 8.02, potentially
8.06, and 9.0 only increase access
privileges.
* All HP-UX bulletins have the prefix HPSBUX, for example bulletin 9311-001
would be requested from HP as HPSBUX9311-001.
- -----------------------------------------------------------------------------
Appendix II: Details of each HP Bulletin
After every patch is installed, be sure to examine /tmp/update.log for any
relevant WARNINGs or ERRORs. This can be done by typing "tail -60
/tmp/update.log | more", then paging through the next three screens via the
space bar, looking for WARNING or ERROR messages.
==================================================
HPSBUX9311-001: Sendmail, dated November 12, 1993
The patch to install depends on which operating system version and series you
are currently using. Use the following chart to determine which patch to
retrieve and install in /tmp:
Operating Series Apply patch
System
HP-UX 8.x 300/400 PHNE_3995
HP-UX 9.x 300/400 PHNE_3996
HP-UX 8.x 700/800 PHNE_3371
HP-UX 9.x 700/800 PHNE_4936 %
No patches will be available for releases of HP-UX prior to 8.0. If you are
running a version prior to 8.0, modify the sendmail configuration file
/usr/lib/sendmail.cf to disable the "prog" mailer function. Directions are
found in HP Bulletin HPSBUX9311-001.
To apply the sendmail patch:
a. Follow the installation instructions included with the patch. The update
process kills the running sendmail, replaces the /usr/lib/sendmail binary,
and starts the new sendmail. If you do not have a frozen configuration
file (/usr/lib/sendmail.fc), skip steps b, c, and d. If you do use a
frozen configuration file, continue with step b.
b. Kill the running sendmail by typing: "/usr/lib/sendmail -bk"
c. Freeze the configuration file by typing: "/etc/freeze"
d. Restart the sendmail daemon by typing: "/usr/lib/sendmail -bd -q30m"
==================================================
HPSBUX9312-002: Xterm, dated November 30, 1993 (revised December 1, 1993)
The patch to install depends on which operating system version and series you
are currently using. Use the following chart to determine which patch to
retrieve and install in /tmp:
Operating Series Apply patch
System
HP-UX 9.x 700/800 PHSS_4996 %
HP-UX 8.x 700 PHSS_3538
HP-UX 8.x 800 PHSS_4218
HP-UX 9.x 300/400 PHSS_5031 %
HP-UX 8.x 300/400 PHSS_4216
No patches will be available for releases of HP-UX prior to 8.0. If you are
running a version prior to 8.0, a workaround can be accomplished by removing
the setuid permissions from xterm. This workaround introduces other problems,
however, and the main recommendation is that the system be upgraded to a
supported version of the operating system.
To install the patch, retrieve the patch and apply it per the installation
instructions included with the patch.
==================================================
HPSBUX9402-003: /etc/subnetconfig, dated February 7, 1994
The patch to install depends on which operating system version and series you
are currently using. The vulnerability only exists in HP-UX version 9.0 and
9.01 and has been fixed in 9.03. Use the following chart to determine which
patch to retrieve and install in /tmp:
Operating Series Apply patch
System
HP-UX 9.0, 9.01 700/800 PHNE_3564
HP-UX 9.0 300/400 PHNE_3563
To install the patch, retrieve the patch and apply it per the installation
instructions included with the patch.
==================================================
HPSBUX9402-004: /dev/nit, dated February 10, 1994
This bulletin did not announce a patch, but noted a vulnerability inherent in
networked machines. The following was taken directly from HPSBUX9402-004:
Essentially, the security vulnerability lies in ANY HP SYSTEM THAT MAKES
NETWORK CONNECTIONS across networks where hosts exist that have an intruder
who has gained root access and is using a network monitoring tool on a
promiscuous mode of a lan interface. The intruder can then gain
information about the HP systems which are using the network for a
connection.
HP supports the promiscuous mode on two products: Apollo Token Ring and
STREAMS- DLPI. These programs allow a root user to access the promiscuous
mode and can therefore be used by an INTRUDER WHO HAS ALREADY GAINED ROOT
ACCESS on the HP system, to learn about OTHER systems which are using the
network.
Systems with the Apollo Token Ring and STREAMS-DLPI are NO MORE VULNERABLE
than any other systems; they just allow intruders that have already cracked
the system, by some other means, to EXTEND the intrusion to other systems
using the attached network.
==================================================
HPSBUX9402-005: hpterm, dated February 22, 1994
The patch to install depends on which operating system and series you are
currently using. Use the following chart to determine which patch to retrieve
and install in /tmp:
Operating Series Apply patch(es)
System
HP-UX 9.X 700/800 PHSS_4995 %
PHSS_4994 %
HP-UX 9.X 300/400 PHSS_4527
PHSS_5027 %
HP-UX 8.X 700 PHSS_4525
HP-UX 8.X 800 PHSS_4526
HP-UX 8.X 300/400 PHSS_4524
==================================================
HPSBUX9402-006: HP DCE/9000 Camera, dated February 24, 1994
The vulnerability exists only in the Camera component of HP DCE/9000, in
versions 1.1 and 1.2 of HP DCE/9000 and the associated HP DCE Developers'
Environment used with HP-UX version 9.X.
Obtain patch PHSS_3820, install it per the installation instructions included
with the patch.
==================================================
HPSBUX9404-007: Advisory on ftpd SITE EXEC, dated April 22, 1994
HP distributed this Advisory to inform their users that their product line was
and is NOT vulnerable to a certain security vulnerability within the UNIX
operating system.
==================================================
HPSBUX9404-008: HP Vue 3.0 dated April 19, 1994
The patch to install depends on which operating system version and series
you are currently using. The vulnerability only exists in HP-UX version
9.X. CERT-NL originally issued S-94-11 on this vulnerability (revised
patches now!). Use the following chart to determine which patch to
retrieve and install in /tmp:
Series Apply patch
700/800 PHSS_4994 %
300/400 PHSS_5027 %
To install the patch, retrieve the patch and apply it per the installation
instructions included with the patch.
Note that this patch is the same patch as in HP Bulletin HPSBUX9402-005 above.
Only one installation of this patch is necessary.
==================================================
HPSBUX9405-009: OSF/AES standard, dated May 5, 1994
The vulnerability only exists on HP 9000 series 700 computers running HP-UX
9.01 or 9.03. Initially, the program cpio had been patched to work around the
problem. Since this bulletin announces patches that remedy the problem, the
workaround to cpio will be superseded via the installation of this cpio patch.
Patch name Operating Series Apply patch(es)
System
OSF/AES patch HP-UX 9.01 700 PHKL_4968 %
OSF/AES patch HP-UX 9.03, 9.05 700 PHKL_4937 %
cpio patch HP-UX 9.X 700 PHCO_3533
Obtain necessary patches, install per the installation instructions included
with the patches.
==================================================
HPSBUX9405-010: ftpd race condition and ftpd home directory, dated May 4, 1994
This Advisory was distributed by HP to address a security issue with ftpd
which was pertinent to many versions of UNIX. HP distributed this Advisory to
inform their users that their product line was and is NOT vulnerable to a
certain security vulnerability within ftpd involving a race condition.
Secondly, HPSBUX9405-010 addressed an ftpd configuration problem. This issue
is that the man page regarding ftpd recommends an insecure configuration for
the permissions on the ftp home directory. The correct recommendation is that
the ftp home directory should be owned by root.
==================================================
HPSBUX9405-011: HP GlancePlus, dated May 4, 1994
This vulnerability exists in product executables on all versions of HP-UX for
HP GlancePlus product revision B.09.00 and earlier for series 700/800 systems
and in the /usr/perf/bin/glance program up to and including revision A.09.06
for series 300/400 systems. The GlancePlus version can be determined on 9.X
systems by using the "what" command.
The fix is to update to the next version of GlancePlus, which is version
B.09.01 on series 700/800 computers and A.09.07 on series 300/400 machines.
No patch will be available for HP-UX 8.X. If you have an 8.X system, the
workaround is to change the permissions to 744 for the files
/usr/bin/ruxux/glance.
==================================================
HPSBUX9405-012: Multimedia Sharedprint, dated May 4, 1994
The vulnerability only exists on HP 9000 series 700 computers running HP-UX
9.X. To fix the problem perform the following three commands as root:
chmod 544 /usr/imaging/pcl/util/update_pcl_fonts
chmod 544 /usr/imaging/pcl/util/ssmak
chmod 544 /usr/imaging/pcl/util/ixmak
==================================================
HPSBUX9406-013: /usr/etc/vhe/vhe_u_mnt, dated June 21, 1994 (Revised July 5,
1994)
The patch to install depends on which operating system version and series you
are currently using. Use the following chart to determine which patch to
retrieve and install in /tmp:
Operating Series Apply patch
System
HP-UX 8.x, 9.x 700/800 PHNE_4434
HP-UX 8.x, 9.x 300/400 PHNE_4363
Obtain necessary patches, install per the installation instructions included
with the patches.
==================================================
HPSBUX9406-014: Patch permissions, dated July 5, 1994
This bulletin describes file permission problems with patches retrieved and
installed prior to the date of this bulletin. The permissions to these
patches were set to vulnerable values. All patches from June 21, 1994 on will
have the correct file permission values.
If you have retrieved and installed patches prior to the date of HP Bulletin
HPSBUX9406-014, then HP recommends that all patch directories in /system
should be examined. This process can be simplified by retrieving HP Bulletin
HPSBUX9406-014 and executing the three scripts supplied with that bulletin.
If you are retrieving patches after June 21, 1994, the patches have all had
their permissions set correctly, and no action need to be taken in response to
this bulletin.
==================================================
HPSBUX9407-015: Xauthority problem, dated July 13, 1994
The vulnerability only exists in HP 9000 series 700 computers, using HP-UX
version 9.X. Under certain conditions Xauthority will not be enabled, which
can allow users logged into the X server's system to access the display
without providing the Xauthority code.
Obtain patch PHSS_5066 % and install it per the installation instructions
included with the patch.
==================================================
HPSBUX9408-016: Patch Checksums dated August 29, 1994, and HPSBUX9408-000:
dated August 31, 1994 (Revised October 12, 1994)
HPSBUX9408-016 was the first HP advisory to announce the availability of
checksums for all previous HP patches, whether or not the patches relate to
security vulnerabilities. HPSBUX9408-016 also contains source to the MD5
checksum utility, as well as a script entitled check_patch which performs the
checking of patches. As more patches were released, HP decided to include the
checksums for the HP security bulletins; these bulletin checksums are
contained in HPSBUX9408-000.
To obtain the MD5 program, follow these steps:
1. Obtain HP Advisory HPSBUX9408-016 from HP as described in the
introduction of this advisory.
2. Extract the MD5 shar file from HPSBUX9408-016 and place it into the file
md5.shar.
3. Unpack the source by typing sh md5.shar
4, Make and test the md5 program by typing make test. You will see the
following output:
cc -c -O -DMD=5 md5c.c
cc -c -O -DMD=5 mddriver.c
cc -o md5 md5c.o mddriver.o
./md5 -x | diff - test.rfc > diffs 2>&1
*** MD5 Test Passed
rm -f diffs
5. Extract the check_patch script from HPSBUX9408-016. This script unpacks a
patch, computes the sums, and finds any matches in the hp-ux_patch_sums
file. The script assumes that the patch and the hp-ux_patch_sums file are
both in the working directory. It also assumes that md5 is installed and
can be reached via $PATH.
There are three ways to retrieve the current list of checksums for the patches
themselves. They can be retrieved via WWW by connecting to HP's WWW server at
http://support.mayfield.hp.com. To receive the list by email, send the words
"send hp-ux_patch_sums" in the text portion of the message to
support@support.mayfield.hp.com. This is the same method used as described
in the introduction of this advisory.
The third, quickest method of retrieving the current list of checksums is to
retrieve them via FTP from support.mayfield.hp.com (IP address 192.6.148.1)
from the file ~/export/patches/hp-ux_patch_sums. Note that this is NOT
available via ANONYMOUS FTP. Detailed directions for FTP access and self-
registration of an account on support.mayfield.hp.com are included in
HPSBUX9408-016.
==================================================
HPSBUX9409-017: CORE-DIAG vulnerability, dated September 21, 1994 (Revised
October 18, 1994, then revised December 1, 1994)
This vulnerability can allow a user to increase their access privileges. The
vulnerability exists for all HP-UX systems using the CORE-DIAG fileset. No
patches will be available for versions of HP_UX prior to version 8.0.
The patch to install depends on which operating system version and series you
are currently using. To determine the operating system version of your
system, display the file /system/UX-CORE/index with the "more" or "pg"
command. The line will look similar to:
fv: A.BX.YY.ZZ
Where X is the major revision, YY is the minor revision, and ZZ is the PCO
index. For example, if your system needed to install an item on the chart
below, (HP-UX 9.00.4A) the major revision would be "9", the minor revision
would be "00" and the PCO index would be "4A". Note that these patches are
quite large. Use the following chart to determine which patch to retrieve and
install in /tmp:
Operating System Series Apply patch
HP-UX 8.0, 8.06 800 PHSS_4578
HP-UX 8.02 800 PHSS_4577
HP-UX 8.05, 8.07 700 PHSS_4574
HP-UX 9.00.2O or 9.00.3A 800 PHSS_4532
HP-UX 9.00.4A 800 PHSS_4660
HP-UX 9.01 700 PHSS_4475
HP-UX 9.03, 9.05 700 PHSS_5037
HP-UX 9.04 800 PHSS_4913
Obtain necessary patches, install per the installation instructions included
with the patches.
==================================================
HPSBUX9410-018: xwcreate and gwind, dated October 12, 1994
The program /usr/bin/X11/xwcreate is used to create X windows and devices
files for raw-mode Starbase applications to display into. The xwcreate program
invokes /usr/bin/X11/gwind which creates the device file. It is possible that
existing files not owned by the user may be removed by using this software.
The patch to install depends on which operating system version and series you
are currently using. Use the following chart to determine which patch to
retrieve and install in /tmp:
Operating Series Apply patch
System
HP-UX 9.x 700/800 PHSS_4832
HP-UX 8.x 700 PHSS_4834
HP-UX 8.x 800 PHSS_4835
HP-UX 9.x 300/400 PHSS_4833
HP-UX 8.x 300/400 PHSS_4836
Obtain necessary patches, install per the installation instructions included
with the patches.
==================================================
HPSBUX9411-019: Support Watch, dated November 30, 1994
This vulnerability, which can allow users to increase their access
privileges, exists ONLY in HP 9000 series 800 running HP-UX revisions 8.0,
8.02, 8.06 and 9.0. Later HP-UX releases including 9.04 are NOT affected by
this vulnerability.
Obtain patch PHSS_4874, install it per the installation instructions included
with the patch.
==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).
All CERT-NL material is available under:
http://cert.surfnet.nl/
In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).
CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).
Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS
Phone: +31 302 305 305 BUSINESS HOURS ONLY
Fax: +31 302 305 329 BUSINESS HOURS ONLY
Snailmail: SURFnet bv
Attn. CERT-NL
P.O. Box 19035
NL - 3501 DA UTRECHT
The Netherlands
NOODGEVALLEN: 06 22 92 35 64 ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64 ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i
iQA/AwUBOL6IDDSYjBqwfc9jEQJP/wCdGXHW+ztOlWcP+TT5pNmnfoPHBCUAoOcE
MuGsAkQp5x5Bf1aTQg/xnk2u
=U68z
-----END PGP SIGNATURE-----
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed