David Ahmad
Symantec
KeyID: 0x26005712
Fingerprint: 8D 9A B1 33 82 3D B3 D0 40 EB AB F0 1E 67 C6 1A 26 00 57 12

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 SECURITY BULLETIN

 REVISION: 0

 Title: SSRT2371 HP OpenVMS Potential POP server local vulnerability

 NOTICE: There are no restrictions for distribution of this
         Bulletin provided that it remains complete and intact.

 RELEASE DATE: September 2002

 SEVERITY: High

 SOURCE: Compaq Computer Corporation,
          a wholly-owned subsidiary of
          Hewlett-Packard Company and
          Hewlett-Packard Company HP Services
          Software Security Response Team

 REFERENCE: SSRT2371

 PROBLEM SUMMARY

   This bulletin will be posted to the support website
   within 24 hours of release to -
   http://thenew.hp.com/country/us/eng/support.html
   Use the SEARCH IN feature box, enter SSRT2371 in the search window.

   SSRT2371 POP server potential vulnerability (Severity HIGH)

     A potential vulnerability has been reported where, under
     certain circumstances, a local authorized non-privileged
     user may gain unauthorized access to privileged files or
     unauthorized privileges. The report is of a potential
     locally exploitable file corruption issue with HP TCP/IP
     services for OpenVMS POP server.

     This problem does not exist if the POP server is disabled.

  VERSIONS IMPACTED

     HP TCP/IP services for OpenVMS version 5.3

     HP TCP/IP services for OpenVMS version 5.1

     HP TCP/IP services for OpenVMS version 5.0a

     HP TCP/IP services for OpenVMS version 4.2

  RESOLUTION

     HP TCP/IP Services for OpenVMS V5.3 ALPHA
     (all supported versions of HP OpenVMS ALPHA):

     Install: HP TCP/IP Services for OpenVMS V5.3 ECO 1
     Prerequisite : HP TCP/IP Services for OpenVMS V5.3 for
                     HP OpenVMSALPHA
     Kit Name: DEC-AXPVMS-TCPIP_ECO-V0503-181-4
     Kit Location:
http://ftp1.support.compaq.com/patches/public/vms/axp/v7.3/tcpip/5.3/

     HP TCP/IP Services for OpenVMS V5.3 VAX
     (all supported versions of HP OpenVMS VAX):

     Install: HP TCP/IP Services for OpenVMS V5.3 ECO 1
     Prerequisite : HP TCP/IP Services for OpenVMS V5.3 for
                     HP OpenVMS VAX
     Kit Name: DEC-VAXVMS-TCPIP_ECO-V0503-181-4
     Kit Location:
http://ftp1.support.compaq.com/patches/public/vms/vax/v7.3/tcpip/5.3/

     Note: Please review the README file(s) for this patch
           prior to installation.

     HP TCP/IP services for OpenVMS 5.1 VAX & ALPHA*:

       Upgrade to HP TCP/IP Services for OpenVMS V5.3
       and install ECO 1 listed above.

       * If you are unable to upgrade please contact your
         normal HP services OpenVMS support channel and request
         HP OpenVMS services elevate a case to TCP/IP Services
         for OpenVMS Support Engineering.

     HP TCP/IP services for OpenVMS 5.0a VAX & ALPHA:
     HP TCP/IP services for OpenVMS 4.2 VAX & ALPHA:

         Upgrade to HP TCP/IP Services for OpenVMS V5.3 and install ECO 1
         listed above if possible. If upgrading is not possible, contact
         your normal HP services OpenVMS support channel and request HP
         OpenVMS services elevate a case to TCP/IP Services for OpenVMS
         Support Engineering.

     To determine if the service is enabled, execute the
     following command:

             $ tcpip show service pop

             Service Port Proto Process Address State

             POP 110 TCP TCPIP$POP 0.0.0.0 Enabled

     After completing the update, HP strongly recommends that
     you perform an immediate backup of your system disk so that
     any subsequent restore operations begin with updated software.
     Otherwise, you must reapply the update after a future restore
     operation. Also, if at some future time you upgrade your system
     to a later patch version, you may need to reapply the appropriate
     update.

 SUPPORT: For further information, contact HP Services.

 SUBSCRIBE: To subscribe to automatically receive future

 Security Advisories from the Software Security Response Team
 (SSRT) via electronic mail:
 http://www.support.compaq.com/patches/mailing-list.shtml

 REPORT: To report a potential security vulnerability with
 any HP or Compaq supported product, send email to:
 security-alerthp.com

 HP and Compaq appreciate your cooperation and patience.
 As always, HP and Compaq urge you to periodically review
 your system management and security procedures. HP
 and Compaq will continue to review and enhance the security
 features of its products and work with our customers to
 maintain and improve the security and integrity of their
 systems.

 "HP and Compaq are broadly distributing this Security
 Bulletin in order to bring to the attention of users of the
 affected Compaq products the important security information
 contained in this Bulletin. HP and Compaq recommend that
 all users determine the applicability of this information
 to their individual situations and take appropriate action.

 Neither HP nor Compaq warrant that this information is
 necessarily accurate or complete for all user situations
 and, consequently, neither HP nor Compaq will be responsible
 for any damages resulting from user's use or disregard of
 the information provided in this Bulletin."

 Copyright 2002 Compaq Information Technologies Group, L.P.
 Compaq shall not be liable for technical or editorial errors
 or omissions contained herein. The information in this
 document is subject to change without notice. Compaq and
 the names of Compaq products referenced herein are
 trademarks of Compaq Information Technologies Group,
 L.P. in the United States and other countries. Other
 product and company names mentioned herein may be trademarks
 of their respective owners.

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.4

iQA/AwUBPZnayznTu2ckvbFuEQL5OACfYuwNgJFpox8zv6vHWSOoRhuYGOAAoL36
wga4uDGXjl9I0wCkHMaa5G+8
=0HcJ
-----END PGP SIGNATURE-----

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]