_____________________________________________________
                       The U.S. Department of Energy
                    Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
            _____________________________________________________

                             INFORMATION BULLETIN

        HP-UX `at' and `cron' vulnerabilities


February 23, 1995 1200 PST                                        Number F-15
_____________________________________________________________________________

PROBLEM:  Security vulnerabilities in the `at' and `cron' commands
    can be used by users to gain unauthorized access privileges.
PLATFORMS:  HP 9000 series 300/400 and/or 700/800s, for HP-UX versions 
    8.x and 9.x.
DAMAGE:    Users can gain unauthorized privileges.
SOLUTION:       Apply appropriate vendor patch as described below.
_____________________________________________________________________________

VULNERABILITY  The security vulnerability in HP-UX `at' and `cron' commands
ASSESSMENT:  can be used by local users to gain unauthorized access
    privileges which may result in system compromise.  CIAC urges
    affected sites to install the appropriate patch as soon as
    possible.
_____________________________________________________________________________
 
       CRITICAL Information about HP-UX `at' and `cron' vulnerability

CIAC has obtained information from Hewlett Packard regarding a new security
vulnerability in the `at' and `cron' commands which will allow local users
to gain unauthorized access privileges.  Specific patch details are provided
below.

The document ftp://ciac.llnl.gov/pub/ciac/bulletin/f-fy95/hppatchs.txt has
been updated to reflect this bulletin.  The hppatchs.txt document contains
the entire list of all HP Bulletins and patches.

IMPORTANT NOTE: Hewlett Packard updates patches periodically.  These updates
are not reflected in the text of each HP bulletin.  The overview presented
here contains current information on the patches available at the time of
the release of this CIAC bulletin.  If you request an updated patch, when
you try to retrieve the patch you will receive a message stating that the
patch is obsolete and the name of the patch which supersedes it.

Hewlett Packard has made sum and MD5 checksums available for their patches
and for their security bulletins.  See the detailed explanation for
HPSBUX9408-016 in CIAC bulletin F-02 for information on how to access and
utilize these checksums.

Following is the copy of the HP bulletin (HPSBUX9502-023):

[Begin HP Bulletin]
-------------------------------------------------------------------------------
Summary of 'Daily Security Bulletins Digest' documents
-------------------------------------------------------------------------------
Document Id    Description            Page 1
-------------------------------------------------------------------------------
HPSBUX9502-023 Security vulnerability in `at' & `cron'

===============================================================================
Detailed list of 'Daily Security Bulletins Digest' documents
===============================================================================
Document Id: [HPSBUX9502-023]
Date Loaded: [02-22-95]

Description: Security vulnerability in `at' & `cron'
===============================================================================

-------------------------------------------------------------------------
      HEWLETT-PACKARD SECURITY BULLETIN: #00023, 22 Feb 95
-------------------------------------------------------------------------

The information in the following Security Bulletin should be acted upon as
soon as possible. Hewlett- Packard will not be liable for any consequences
to any customer resulting from customer's failure to fully implement
instructions in this Security Bulletin as soon as possible.

_______________________________________________________________________
PROBLEM:  Security vulnerability in the `at' and `cron' command in HP-UX
PLATFORM: HP 9000 series 300/400s and/or 700/800s
DAMAGE:   Users can gain unauthorized privileges
SOLUTION: Apply patch PHCO_5203 (series 700    , HP-UX 8.X), or
                      PHCO_5204 (series 800    , HP-UX 8.X), or
                      PHCO_5199 (series 300/400, HP-UX 8.X), or
                      PHCO_5178 (series 700    , HP-UX 9.X), or
                      PHCO_5193 (series 800    , HP-UX 9.X), or
                      PHCO_5206 (series 300/400, HP-UX 9.0), or
                      PHCO_5206 (series 300/400, HP-UX 9.03).
AVAILABILITY: All patches are available now.
_______________________________________________________________________

I. Update

   A. It has been found that all HP-UX systems have this vulnerability.

   B. Fixing the problem

      The vulnerability can be eliminated from releases 8.X and 9.X of
      HP-UX by applying a patch.

      All customers concerned with the security of their HP-UX systems
      should apply the appropriate patch described above as soon as possible.

   C. How to Install the Patch (for HP-UX 8.X and 9.X)

   1.  Determine which patch is appropriate for your hardware platform and
       operating system:

                      PHCO_5203 (series 700    , HP-UX 8.X), or
                      PHCO_5204 (series 800    , HP-UX 8.X), or
                      PHCO_5199 (series 300/400, HP-UX 8.X), or
                      PHCO_5178 (series 700    , HP-UX 9.X), or
                      PHCO_5193 (series 800    , HP-UX 9.X), or
                      PHCO_5206 (series 300/400, HP-UX 9.0), or
                      PHCO_5206 (series 300/400, HP-UX 9.03).

   2.  Hewlett Packard's HP-UX patches are available via email & WWW
        (MOSAIC).

        To obtain a copy of the HP SupportLine email service user's guide,
        send the following in the TEXT PORTION OF THE MESSAGE to
        support@support.mayfield.hp.com (no Subject is required):

                      send guide

        The users guide explains the process for downloading HP-UX patches
        via email and other services available.


        WWW (MOSAIC) service (downloading of patches) is
        also available via WWW (MOSAIC) our URL is:

        (http://support.mayfield.hp.com)


   3.  Apply the patch to your HP-UX system.

   4.  Examine /tmp/update.log for any relevant WARNINGs or ERRORs.  This
       can be done as follows:

       a.  At the shell prompt, type "tail -60 /tmp/update.log | more"
       b.  Page through the next three screens via the space bar, looking
           for WARNING or ERROR messages.


   D. Impact of the patch and workaround

       The patch for HP-UX releases 8.X and 9.X provides a new version of
       /etc/cron and /usr/bin/at which fixes the vulnerability.


   E. To subscribe to automatically receive future NEW HP Security Bulletins
      from the HP SupportLine mail service via electronic mail,
      send an email message to:

      support@support.mayfield.hp.com   (no Subject is required)

      Multiple instructions are allowed in the TEXT PORTION OF THE MESSAGE,
      here are some basic instructions you may want to use:

      * To add your name to the subscription list for new security
        bulletins, send the following in the TEXT PORTION OF THE MESSAGE:

                  subscribe security_info

      * To retrieve the index of all HP Security Bulletins issued to date,
        send the following in the TEXT PORTION OF THE MESSAGE:

                  send security_info_list

        WWW (MOSAIC) service (Browsing of Bulletins) is also available via
        WWW.  Our URL is:

                  (http://support.mayfield.hp.com)

        Choose "Support news", then under Support news,
        choose "Security Bulletins"

   F. To report new security vulnerabilities, send email to

                security-alert@hp.com
_______________________________________________________________________
[End HP Bulletin]

CIAC is the computer security incident response team for the U.S.
Department of Energy.  Services are available free of charge to DOE and DOE
contractors.

DOE and DOE contractor sites can contact CIAC at:
    Voice:   510-422-8193
    FAX:     510-423-8002
    STU-III: 510-423-2604
    E-mail:  ciac@llnl.gov

Previous CIAC notices, anti-virus software, and other information are
available on the Internet via anonymous FTP from ciac.llnl.gov (IP address
128.115.19.53).

CIAC has several self-subscribing mailing lists for electronic publications:
1.  CIAC-BULLETIN for Advisories, highest priority - time critical
    information, and Bulletins, important computer security information;
2.  CIAC-NOTES for Notes, a collection of computer security articles;
3.  SPI-ANNOUNCE for official news about Security Profile Inspector (SPI)
    software updates, new features, distribution and availability;
4.  SPI-NOTES, for discussion of problems and solutions regarding the use of
    SPI products.

Our mailing lists are managed by a public domain software package called
ListProcessor, which ignores E-mail header subject lines. To subscribe (add
yourself) to one of our mailing lists, send requests of the following form:

subscribe list-name LastName, FirstName PhoneNumber

as the E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES,
SPI-ANNOUNCE or SPI-NOTES for "list-name" and valid information for
"LastName" "FirstName" and "PhoneNumber."  Send to: ciac-listproc@llnl.gov
not to: ciac@llnl.gov

e.g.,
subscribe ciac-notes O'Hara, Scarlett 404-555-1212 x36
subscribe ciac-bulletin O'Hara, Scarlett 404-555-1212 x36

You will receive an acknowledgment containing address and initial PIN, and
information on how to change either of them, cancel your subscription, or get
help.
_____________________________________________________________________________

PLEASE NOTE: Many users outside of the DOE and ESnet computing communities
receive CIAC bulletins. If you are not part of these communities, please
contact your agency's response team to report incidents. Your agency's team
will coordinate with CIAC. The Forum of Incident Response and Security Teams
(FIRST) is a world-wide organization. A list of FIRST member organizations
and their constituencies can be obtained by sending E-mail to
first-request@first.org with an empty subject line and a message body
containing the line: send first-contacts.

This document was prepared as an account of work sponsored by an agency of
the United States Government. Neither the United States Government nor the
University of California nor any of their employees, makes any warranty,
expressed or implied, or assumes any legal liability or responsibility for
the accuracy, completeness, or usefulness of any information, product, or
process disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products, process,
or service by trade name, trademark manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation, or favoring
by the United States Government or the University of California. The views
and opinions of authors expressed herein do not necessarily state or reflect
those of the United States Government nor the University of California, and
shall not be used for advertising or product endorsement purposes.

_____________________________________________________________________________