_____________________________________________________
                       The U.S. Department of Energy
                    Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
            _____________________________________________________

                              INFORMATION BULLETIN

                      Summary of HP Security Bulletins

November 17, 1994 1300 PST                                        Number F-02
_____________________________________________________________________________

PROBLEM:        Security vulnerabilities in all versions of HP UX.
PLATFORM:       All Hewlett Packard systems.
DAMAGE:         Unauthorized access to system and files, denial of service.
SOLUTION:       Apply appropriate security patches.
_____________________________________________________________________________

VULNERABILITY   Many of these vulnerabilities are widely known and used to
ASSESSMENT:     compromise systems.  CIAC urges affected sites to install the
                appropriate patches immediately.
______________________________________________________________________________

              Critical Information about HP Security Bulletins

CIAC has compiled a summary of all security related patches currently 
available from Hewlett Packard.  The patches are presented first in a table 
format, then a summary of the vulnerability information is presented for each 
patch in the order in which the HP Bulletins were distributed.

HP has set up an automatic server to allow patches and other security 
information to be retrieved over the Internet.  To utilize this server, send a 
message to support@support.mayfield.hp.com.  The subject line of the message 
will be ignored. The body (text) of the message should contain the words

send XXXX

where XXXX is the identifier for the information you want retrieved.  For 
example, to retrieve the patch PHSS_4834, the message would be "send 
PHSS_4834".

Other information that can be retrieved include the HP SupportLine mail 
service user's guide (send guide.txt), the readme file for a patch (send doc 
PHSS_4834), and the original HP bulletin (send doc HPSBUX9410-018).

HP also has a World Wide Web server to browse and retrieve bulletins and 
patches.  To utilize this server, use a WWW client and connect to 
http://support.mayfield.hp.com.

IMPORTANT NOTE:  Hewlett Packard updates patches periodically.  These updates 
are not reflected in the text of each HP bulletin.  The overview presented 
here contains current information on the patches available at the time of the 
release of this CIAC bulletin.  If you request an updated patch, when you try 
to retrieve the patch you will receive a message stating that the patch is 
obsolete and the name of the patch which supersedes it.

Hewlett Packard has made sum and MD5 checksums available for their patches and 
for their security bulletins.  See the detailed explanation for HPSBUX9408-016 
for information on how to access and utilize these checksums.

_____________________________________________________________________________

CIAC wishes to thank Hewlett Packard for helping CIAC construct this summary.
_____________________________________________________________________________


For additional information or assistance, please contact CIAC:
    Voice:   510-422-8193
    FAX:     510-423-8002
    STU-III: 510-423-2604
    E-mail:  ciac@llnl.gov

Previous CIAC Bulletins and other information are available via anonymous FTP 
from ciac.llnl.gov (IP address 128.115.19.53).

CIAC has several self-subscribing mailing lists for electronic publications:
1.  CIAC-BULLETIN for Advisories, highest priority - time critical 
    information, and Bulletins, important computer security information;
2.  CIAC-NOTES for Notes, a collection of computer security articles;
3.  SPI-ANNOUNCE for official news about Security Profile Inspector (SPI)
    software updates, new features, distribution and availability;
4.  SPI-NOTES, for discussion of problems and solutions regarding the use of
    SPI products.

CIAC's mailing lists are managed by a public domain software package called 
ListProcessor, which ignores E-mail header subject lines. To subscribe (add 
yourself) to one of our mailing lists, send the following request as the
E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES, SPI-ANNOUNCE or 
SPI-NOTES for "list-name" and valid information for "LastName" "FirstName" 
and "PhoneNumber" when sending

E-mail to ciac-listproc@llnl.gov:
          subscribe list-name LastName, FirstName PhoneNumber
    e.g., subscribe ciac-notes O'Hara, Scarlett 404-555-1212 x36

You will receive an acknowledgment containing address, initial PIN, and 
information on how to change either of them, cancel your subscription, or get 
help.
_____________________________________________________________________________

PLEASE NOTE: Many users outside of the DOE and ESnet computing communities 
receive CIAC bulletins. If you are not part of these communities, please 
contact your agency's response team to report incidents. Your agency's team 
will coordinate with CIAC. The Forum of Incident Response and Security Teams 
(FIRST) is a world-wide organization. A list of FIRST member organizations 
and their constituencies can be obtained by sending E-mail to
first-request@first.org with an empty subject line and a message body 
containing the line: send first-contacts.

This document was prepared as an account of work sponsored by an agency of 
the United States Government. Neither the United States Government nor the 
University of California nor any of their employees, makes any warranty, 
expressed or implied, or assumes any legal liability or responsibility for 
the accuracy, completeness, or usefulness of any information, product, or 
process disclosed, or represents that its use would not infringe privately 
owned rights. Reference herein to any specific commercial products, process, 
or service by trade name, trademark manufacturer, or otherwise, does not 
necessarily constitute or imply its endorsement, recommendation, or favoring 
by the United States Government or the University of California. The views 
and opinions of authors expressed herein do not necessarily state or reflect 
those of the United States Government nor the University of California, and 
shall not be used for advertising or product endorsement purposes.




Appendix 1: Table of HP Security Bulletins


 * HP    Progs                                 Patches to      Overview of
Bulletin Affected     Platform                 Install         Vulnerability

9311-001 sendmail     HP 9000 300,400,700,800  1 of 4 patches  A mail message
                      HP-UX 8.x, 9.x           dependent on    can cause 
                                               configuration   system commands
                                                               to be executed

9312-002 Xterm        HP 9000 300,400,700,800  1 of 5 patches  The logging 
                      HP-UX 8.x, 9.x           dependent on    function of 
                                               configuration   xterm allows 
                                                               local users to 
                                                               create or 
                                                               modify files

9402-003 /etc/        HP 9000 300,400,700,800  1 of 2 patches  /etc/
         subnetconfig HP-UX 9.0/9.1            dependent on    subnetconfig 
                                               configuration   can allow users
                                                               to increase 
                                                               their 
                                                               privileges

9402-004 /dev/nit     HP 9000 300,400,700,800  Evaluate        Be aware of
                      HP-UX Apollo Token Ring  necessity of    vulnerabilities
                      or STREAMS-DLPI          having the      inherent in the
                                               machine on a    nature of a
                                               network         networked 
                                                               machine

9402-005 hpterm       HP 9000 300,400,700,800  1 or 2 patches  Users can gain
                      hpterm Revision 2.89 or  dependent on    access to files
                      earlier                  configuration;  regardless of 
                                               or use hpterm   file ownership 
                                               Rev 2.90/higher and permissions

9402-006 HP DCE       HP 9000 series 700,800   1 patch         Unauthorized
         Camera       at revision 9.x                          root access

9404-007 Advisory     none                     none            Announcement
         only                                                  that HP is not
                                                               vulnerable
                                                               to the SITE 
                                                               EXEC problem

9404-008 HP Vue 3.0   HP 9000 300,400,700,800  1 of 2 patches  Unauthorized
                      HP-UX 9.x                dependent on    root access
                                               configuration

9405-009 OSF/AES      HP 9000 series 700,      Install 2       Root grants
         standard     HP-UX 9.01 or 9.03       patches         improper
                                                               ownership of 
                                                               files and
                                                               directories

9405-010 ftpd home    All HP-UX systems        root should     Anonymous users
         directory                             own ftp home    can change
                                               directory       permissions on
                                                               files

9405-011 HP           HP 9000 series 300/400,  1 patch or      Non-root users 
         GlancePlus   700/800                  update product  can use glance
         rev B.09.00                           for HP-UX 9.x   or gpm to gain 
         and earlier                           or use          root privs
                                               workaround in
                                               HP-UX 8.x

9405-012 Multimedia   HP 9000 series 700 at    change file     files were SUID
         Sharedprint  HP-UX rev 9.x            permissions on
                                               three files

9406-013 /usr/etc/vhe HP 9000 300,400,700,800  1 of 2 patches  Unauthorized
         /vhe_u_mnt   HP-UX 8.x, 9.x           dependent on    root access
                                               configuration

9406-014 Permissions  All HP-UX systems        Script for      Patch files may
         of patches                            patches         have become
         installed                             obtained before corrupted
         before                                June 21, 1994
         6/21/94

9407-015 Xauthority   HP 9000 series 700       Install 1 patch Unauthorized
                                                               access to the 
                                                               display

9408-016 Advisory     All HP-UX systems        none            HP patch 
9408-000 only                                                  checksums and 
                                                               HP security
                                                               bulletin
                                                               checksums

9409-017 System       HP 9000 700,800          Install         Users can
         Message      HP-UX 8.x, 9.x           appropriate     increase their 
         catalog                               patch(es)       privileges
         (fileset                              dependent upon
         CORE-DIAG)                            configuration

9410-018 xwcreate and HP 9000 300,400,700,800  Install 1 patch Files not owned 
         gwind        HP-UX 8.x, 9.x                           by a user can 
                                                               be removed by 
                                                               non-root users


* All HP-UX bulletins have the prefix HPSBUX, for example bulletin 9311-001 
would be requested from HP as HPSBUX9311-001.


Appendix II: Details of each HP Bulletin


After every patch is installed, be sure to examine /tmp/update.log for any 
relevant WARNINGs or ERRORs.  This can be done by typing  "tail -60 
/tmp/update.log | more", then paging through the next three screens via the 
space bar, looking for WARNING or ERROR messages.

==================================================
HPSBUX9311-001: Sendmail, dated November 12, 1993

The patch to install depends on which operating system version and series you 
are currently using.  Use the following chart to determine which patch to 
retrieve and install in /tmp:

Operating      Series        Apply patch
System    

HP-UX 8.x      300/400        PHNE_3995
HP-UX 9.x      300/400        PHNE_3996
HP-UX 8.x      700/800        PHNE_3371
HP-UX 9.x      700/800        PHNE_4533

No patches will be available for releases of HP-UX prior to 8.0.  If you are 
running a version prior to 8.0, modify the sendmail configuration file 
/usr/lib/sendmail.cf to disable the "prog" mailer function.  Directions are 
found in HP Bulletin HPSBUX9311-001.

To apply the sendmail patch:

a.  Follow the installation instructions included with the patch.  The update 
    process kills the running sendmail, replaces the /usr/lib/sendmail binary, 
    and starts the new sendmail.  If you do not have a frozen configuration 
    file (/usr/lib/sendmail.fc), skip steps b, c, and d.  If you do use a 
    frozen configuration file, continue with step b.

b.  Kill the running sendmail by typing:  "/usr/lib/sendmail -bk"

c.  Freeze the configuration file by typing:  "/etc/freeze"

d.  Restart the sendmail daemon by typing: "/usr/lib/sendmail -bd -q30m"

==================================================
HPSBUX9312-002: Xterm, dated November 30, 1993 (revised December 1, 1993)

The patch to install depends on which operating system version and series you 
are currently using.  Use the following chart to determine which patch to 
retrieve and install in /tmp:

Operating          Series           Apply patch
System    

HP-UX 9.x          700/800          PHSS_4866
HP-UX 8.x          700              PHSS_3538
HP-UX 8.x          800              PHSS_4218
HP-UX 9.x          300/400          PHSS_4219
HP-UX 8.x          300/400          PHSS_4216

No patches will be available for releases of HP-UX prior to 8.0.  If you are 
running a version prior to 8.0, a workaround can be accomplished by removing 
the setuid permissions from xterm.  This workaround introduces other problems, 
however, and the main recommendation is that the system be upgraded to a 
supported version of the operating system.

To install the patch, retrieve the patch and apply it per the installation 
instructions included with the patch.

==================================================
HPSBUX9402-003: /etc/subnetconfig, dated February 7, 1994

The patch to install depends on which operating system version and series you 
are currently using.  The vulnerability only exists in HP-UX version 9.0 and 
9.01 and has been fixed in 9.03.  Use the following chart to determine which 
patch to retrieve and install in /tmp:

Operating            Series          Apply patch
System

HP-UX 9.0, 9.01      700/800         PHNE_3564
HP-UX 9.0            300/400         PHNE_3563

To install the patch, retrieve the patch and apply it per the installation 
instructions included with the patch.

==================================================
HPSBUX9402-004: /dev/nit, dated February 10, 1994

This bulletin did not announce a patch, but noted a vulnerability inherent in 
networked machines.  The following was taken directly from HPSBUX9402-004:

   Essentially, the security vulnerability lies in ANY HP SYSTEM THAT MAKES 
   NETWORK CONNECTIONS across networks where hosts exist that have an intruder 
   who has gained root access and is using a network monitoring tool on a 
   promiscuous mode of a lan interface.  The intruder can then gain 
   information about the HP systems which are using the network for a 
   connection.

HP supports the promiscuous mode on two products: Apollo Token Ring and 
STREAMS- DLPI.  These programs allow a root user to access the promiscuous 
mode and can therefore be used by an INTRUDER WHO HAS ALREADY GAINED ROOT 
ACCESS on the HP system, to learn about OTHER systems which are using the 
network.

Systems with the Apollo Token Ring and STREAMS-DLPI are NO MORE VULNERABLE 
than any other systems; they just allow intruders that have already cracked 
the system, by some other means, to EXTEND the intrusion to other systems 
using the attached network.

==================================================
HPSBUX9402-005: hpterm, dated February 22, 1994

The patch to install depends on which operating system and series you are 
currently using.  Use the following chart to determine which patch to retrieve 
and install in /tmp:

Operating       Series              Apply patch(es)
System    

HP-UX 9.X       700/800             PHSS_4685
                                    PHSS_4865
HP-UX 9.X       300/400             PHSS_4527
                                    PHSS_4517
HP-UX 8.X       700                 PHSS_4525
HP-UX 8.X       800                 PHSS_4526
HP-UX 8.X       300/400             PHSS_4524


==================================================
HPSBUX9402-006: HP DCE/9000 Camera, dated February 24, 1994

The vulnerability exists only in the Camera component of HP DCE/9000, in 
versions 1.1 and 1.2 of HP DCE/9000 and the associated HP DCE Developers' 
Environment used with HP-UX version 9.X.

Obtain patch PHSS_3820, install it per the installation instructions included 
with the patch.

==================================================
HPSBUX9404-007: Advisory on ftpd SITE EXEC, dated April 22, 1994

HP distributed this Advisory to inform their users that their product line was 
and is NOT vulnerable to a certain security vulnerability within the UNIX 
operating system.

==================================================
HPSBUX9404-008: HP Vue 3.0 dated April 19, 1994

The patch to install depends on which operating system version and series you 
are currently using.  The vulnerability only exists in HP-UX version 9.X. CIAC 
issued CIAC Bulletin E-23 on this vulnerability.  Use the following chart to 
determine which patch to retrieve and install in /tmp:

Series           Apply patch

700/800          PHSS_4865
300/400          PHSS_4517

To install the patch, retrieve the patch and apply it per the installation 
instructions included with the patch.

Note that this patch is the same patch as in HP Bulletin HPSBUX9402-005 above. 
Only one installation of this patch is necessary.

==================================================
HPSBUX9405-009: OSF/AES standard, dated May 5, 1994

The vulnerability only exists on HP 9000 series 700 computers running HP-UX 
9.01 or 9.03.  Initially, the program cpio had been patched to work around the 
problem. Since this bulletin announces patches that remedy the problem, the 
workaround to cpio will be superseded via the installation of this cpio patch.

Patch name        Operating           Series        Apply patch(es)
                  System    

OSF/AES patch     HP-UX 9.01           700          PHKL_4942
OSF/AES patch     HP-UX 9.03, 9.05     700          PHKL_4943
cpio patch        HP-UX 9.X            700          PHCO_3533

Obtain necessary patches, install per the installation instructions included 
with the patches.

==================================================
HPSBUX9405-010: ftpd race condition and ftpd home directory, dated May 4, 1994

This Advisory was distributed by HP to address a security issue with ftpd 
which was pertinent to many versions of UNIX.  HP distributed this Advisory to 
inform their users that their product line was and is NOT vulnerable to a 
certain security vulnerability within ftpd involving a race condition.

Secondly, HPSBUX9405-010 addressed an ftpd configuration problem.  This issue 
is that the man page regarding ftpd recommends an insecure configuration for 
the permissions on the ftp home directory.  The correct recommendation is that 
the ftp home directory should be owned by root.

==================================================
HPSBUX9405-011: HP GlancePlus, dated May 4, 1994

This vulnerability exists in product executables on all versions of HP-UX for 
HP GlancePlus product revision B.09.00 and earlier for series 700/800 systems 
and in the /usr/perf/bin/glance program up to and including revision A.09.06 
for series 300/400 systems.  The GlancePlus version can be determined on 9.X 
systems by using the "what" command.

The fix is to update to the next version of GlancePlus, which is version 
B.09.01 on series 700/800 computers and A.09.07 on series 300/400 machines.

No patch will be available for HP-UX 8.X.  If you have an 8.X system, the 
workaround is to change the permissions to 744 for the files 
/usr/bin/ruxux/glance.

==================================================
HPSBUX9405-012: Multimedia Sharedprint, dated May 4, 1994

The vulnerability only exists on HP 9000 series 700 computers running HP-UX 
9.X. To fix the problem perform the following three commands as root:

chmod 544 /usr/imaging/pcl/util/update_pcl_fonts
chmod 544 /usr/imaging/pcl/util/ssmak
chmod 544 /usr/imaging/pcl/util/ixmak

==================================================
HPSBUX9406-013: /usr/etc/vhe/vhe_u_mnt, dated June 21, 1994 (Revised July 5, 
1994)

The patch to install depends on which operating system version and series you 
are currently using.  Use the following chart to determine which patch to 
retrieve and install in /tmp:

Operating             Series           Apply patch
System    

HP-UX 8.x, 9.x        700/800          PHNE_4434
HP-UX 8.x, 9.x        300/400          PHNE_4363

Obtain necessary patches, install per the installation instructions included 
with the patches.

==================================================
HPSBUX9406-014: Patch permissions, dated July 5, 1994

This bulletin describes file permission problems with patches retrieved and 
installed prior to the date of this bulletin.  The permissions to these 
patches were set to vulnerable values.  All patches from June 21, 1994 on will 
have the correct file permission values.

If you have retrieved and installed patches prior to the date of HP Bulletin 
HPSBUX9406-014, then HP recommends that all patch directories in /system 
should be examined.  This process can be simplified by retrieving HP Bulletin 
HPSBUX9406-014 and executing the three scripts supplied with that bulletin.

If you are retrieving patches after June 21, 1994, the patches have all had 
their permissions set correctly, and no action need to be taken in response to 
this bulletin.

==================================================
HPSBUX9407-015: Xauthority problem, dated July 13, 1994

The vulnerability only exists in HP 9000 series 700 computers, using HP-UX 
version 9.X.  Under certain conditions Xauthority will not be enabled, which 
can allow users logged into the X server's system to access the display 
without providing the Xauthority code.

Obtain patch PHSS_4820 and install it per the installation instructions 
included with the patch.

==================================================
HPSBUX9408-016: Patch Checksums dated August 29, 1994, and HPSBUX9408-000: 
dated August 31, 1994 (Revised October 12, 1994)

HPSBUX9408-016 was the first HP advisory to announce the availability of 
checksum s for all previous HP patches, whether or not the patches relate to 
security vulnerabilities. HPSBUX9408-016 also contains source to the MD5 
checksum utility, as well as a script entitled check_patch which performs the 
checking of patches. As more patches were released, HP decided to include the 
checksums for the HP security bulletins; these bulletin checksums are 
contained in HPSBUX9408-000.

To obtain the MD5 program, following these steps:

1.  Obtain HP Advisory HPSBUX9408-016 from HP by using the information 
    contained on the first page of this CIAC Bulletin.

2.  Extract the MD5 shar file from HPSBUX9408-016 and place it into the file 
    md5.shar.

3.  Unpack the source by typing  sh md5.shar

4,  Make and test the md5 program by typing  make test.  You will see the 
    following output:

        cc -c -O -DMD=5 md5c.c
        cc -c -O -DMD=5 mddriver.c
        cc -o md5 md5c.o mddriver.o
        ./md5 -x | diff - test.rfc > diffs 2>&1
        *** MD5 Test Passed
        rm -f diffs

5.  Extract the check_patch script from HPSBUX9408-016.  This script unpacks a 
    patch, computes the sums, and finds any matches in the hp-ux_patch_sums 
    file.  The script assumes that the patch and the hp-ux_patch_sums file are 
    both in the working directory.  It also assumes that md5 is installed and 
    can be reached via $PATH.

There are three ways to retrieve the current list of checksums for the patches 
themselves.  They can be retrieved via WWW by connecting to HP's WWW server at 
http://support.mayfield.hp.com.  To receive the list by email, send the words 
"send hp-ux_patch_sums" in the text portion of the message to 
support@support.mayfield.hp.com. This is the same method used as in the first 
page of this CIAC bulletin.

The third, quickest method of retrieving the current list of checksums is to 
retrieve them via FTP from support.mayfield.hp.com (IP address 192.6.148.1) 
from the file ~/export/patches/hp-ux_patch_sums.  Note that this is NOT 
available via ANONYMOUS FTP.  Detailed directions for FTP access and self-
registration of an account on support.mayfield.hp.com are included in 
HPSBUX9408-016.

==================================================
HPSBUX9409-017: CORE-DIAG vulnerability, dated September 21, 1994 (Revised 
October 18, 1994)

This vulnerability can allow a user to increase their access privileges.  The 
vulnerability exists for all HP-UX systems using the CORE-DIAG fileset.  No 
patches will be available for versions of HP_UX prior to version 8.0.

The patch to install depends on which operating system version and series you 
are currently using.  To determine the operating system version of your 
system, display the file /system/UX-CORE/index with the "more" or "pr" 
command. The line will look similar to:

          fv:  A.BX.YY.ZZ

Where X is the major revision, YY is the minor revision, and ZZ is the PCO 
index. For example, if your system needed to install the last item on the 
chart below, (HP-UX 9.04.1k) the major revision would be "9", the minor 
revision would be "04" and the PCO index would be "1K".  Note that these 
patches are quite large. Use the following chart to determine which patch to 
retrieve and install in /tmp:

Operating System             Series        Apply patch

HP-UX 8.05, 8.07              700          PHSS_4574
HP-UX 9.01                    700          PHSS_4475
HP-UX 9.03, 9.05              700          PHSS_4863
HP-UX 8.0, 8.06               800          PHSS_4578
HP-UX 8.02                    800          PHSS_4577
HP-UX 9.00.2O or 9.00.3A      800          PHSS_4532
HP-UX 9.00.4A                 800          PHSS_4660
HP-UX 9.04.1K or 9.04.2A      800          PHSS_4749

Obtain necessary patches, install per the installation instructions included 
with the patches.

==================================================
HPSBUX9410-018: xwcreate and gwind, dated October 12, 1994

The program /usr/bin/X11/xwcreate is used to create X windows and devices 
files for raw-mode Starbase applications to display into. The xwcreate program 
invokes /usr/bin/X11/gwind which creates the device file.  It is possible that 
existing files not owned by the user may be removed by using this software.

The patch to install depends on which operating system version and series you 
are currently using.  Use the following chart to determine which patch to 
retrieve and install in /tmp:

Operating          Series            Apply patch
System    

HP-UX 9.x          700/800           PHSS_4832
HP-UX 8.x          700               PHSS_4834
HP-UX 8.x          800               PHSS_4835
HP-UX 9.x          300/400           PHSS_4833
HP-UX 8.x          300/400           PHSS_4836

Obtain necessary patches, install per the installation instructions included 
with the patches.

____________________________________________________________________________