|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
From: IT Resource Center (support_feedback_at_us-support-mail.external.hp.com)
Date: Thu Aug 08 2002 - 07:04:57 CDT
HP Support Information Digests
===============================================================================
o Security Bulletin Digest Split
------------------------------
The security bulletins digest has been split into multiple digests
based on the operating system (HP-UX, MPE/iX, and HP Secure OS
Software for Linux). You will continue to receive all security
bulletin digests unless you choose to update your subscriptions.
To update your subscriptions, use your browser to access the
IT Resource Center on the World Wide Web at:
http://www.itresourcecenter.hp.com/
Under the Maintenance and Support Menu, click on the "more..." link.
Then use the 'login' link at the left side of the screen to login
using your IT Resource Center User ID and Password.
Under the notifications section (near the bottom of the page), select
Support Information Digests.
To subscribe or unsubscribe to a specific security bulletin digest,
select or unselect the checkbox beside it. Then click the
"Update Subscriptions" button at the bottom of the page.
o IT Resource Center World Wide Web Service
---------------------------------------------------
If you subscribed through the IT Resource Center and would
like to be REMOVED from this mailing list, access the
IT Resource Center on the World Wide Web at:
http://www.itresourcecenter.hp.com/
Login using your IT Resource Center User ID and Password.
Then select Support Information Digests (located under
Maintenance and Support). You may then unsubscribe from the
appropriate digest.
===============================================================================
Digest Name: daily HP-UX security bulletins digest
Created: Thu Aug 8 3:00:02 PDT 2002
Table of Contents:
Document ID Title
--------------- -----------
HPSBUX0208-206 Sec. Vulnerability in ptrace(2)
HPSBUX0208-208 Sec. Vulnerability in HP OpenView EMANATE14.2
HPSBUX0208-207 Sec. Vulnerability in HP Apache Server PHP
HPSBUX0207-197 Sec. Vulnerability in Apache Server Chunk Encoding Rev 06
HPSBUX0202-184 Sec. Vulnerability in SNMP (rev. 14)
The documents are listed below.
-------------------------------------------------------------------------------
Document ID: HPSBUX0208-206
Date Loaded: 20020805
Title: Sec. Vulnerability in ptrace(2)
TEXT
-----------------------------------------------------------------
HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0208-206
Originally issued: 06 Aug 2002
-----------------------------------------------------------------
The information in the following Security Bulletin should be
acted upon as soon as possible. Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.
------------------------------------------------------------------
PROBLEM: Improper use of ptrace(2) could panic the system.
PLATFORM: HP 9000 Servers running HP-UX release 11.00, 11.04, and
11.11.
DAMAGE: Possible denial of service.
SOLUTION: Apply the appropriate patches for HP-UX releases:
HP-UX 11.00 - PHKL_27180
HP-UX 11.04 - PHKL_27536
HP-UX 11.11 - PHKL_27179
MANUAL ACTIONS: None
AVAILABILITY: The patches are available now on itrc.hp.com.
------------------------------------------------------------------
A. Background
HP has discovered that an incorrect reference to thread
register state can cause a data page fault panic.
B. Recommended solution
Retrieve and apply the appropriate patch from itrc.hp.com
HP-UX 11.00 - PHKL_27180
HP-UX 11.04 - PHKL_27536
HP-UX 11.11 - PHKL_27179
C. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:
Use your browser to get to the HP IT Resource Center page
at:
Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.
To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.
For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA"
The security patch matrix is also available via anonymous
ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".
D. To report new security vulnerabilities, send email to
security-alert
hp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alerthp.com.
Permission is granted for copying and circulating this
Bulletin to Hewlett-Packard (HP) customers (or the Internet
community) for the purpose of alerting them to problems,
if and only if, the Bulletin is not edited or changed in
any way, is attributed to HP, and provided such reproduction
and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. HP is not
liable for any misuse of this information by any third party.
________________________________________________________________
-----End of Document ID: HPSBUX0208-206--------------------------------------
Document ID: HPSBUX0208-208
Date Loaded: 20020807
Title: Sec. Vulnerability in HP OpenView EMANATE14.2
TEXT
-----------------------------------------------------------------
HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0208-208
Originally issued: 08 Aug. 2002
-----------------------------------------------------------------
The information in the following Security Bulletin should be
acted upon as soon as possible. Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.
------------------------------------------------------------------
PROBLEM: The HP OpenView EMANATE14.2 read-write community string
may be exposed.
PLATFORM: HP 9000 Series 700 and Series 800 running HP-UX
and EMANATE14.2.
Solaris 2.6,7,8 running EMANATE14.2.
Win NT/2k running EMANATE14.2.
DAMAGE: Possible unauthorized access, denial of service.
SOLUTION: Apply the appropriate patch and restrict access to
the community name.
Win NT/2k: NNM_00936 EMANATE14.2 snmpModules of SNMPv2 MIB
hp-ux 10.20: PHSS_27569 EMANATE14.2 snmpModules of SNMPv2 MIB
hp-ux 11.X: PHSS_27570 EMANATE14.2 snmpModules of SNMPv2 MIB
Solaris 2.6,7,8: PSOV_03193 EMANATE14.2 snmpModules of SNMPv2 MIB
MANUAL ACTIONS: Restrict access to the community name by
modifying snmpd.conf.
AVAILABILITY: The patches are available now.
------------------------------------------------------------------
A. Background
There are two parts to the problem. The patches address the
'read-only' community access. Also, it is possible to guess
the community-name. The solution for that part of the problem
is to restrict access to the community name.
B. Recommended solution
1. Install the appropriate patch:
Win NT/2k: NNM_00936 EMANATE14.2 snmpModules of SNMPv2 MIB
hp-ux 10.20: PHSS_27569 EMANATE14.2 snmpModules of SNMPv2 MIB
hp-ux 11.X: PHSS_27570 EMANATE14.2 snmpModules of SNMPv2 MIB
Solaris 2.6,7,8: PSOV_03193 EMANATE14.2 snmpModules of SNMPv2 MIB
The patches are available from
http://support.openview.hp.com/cpe/patches/
2. Setup a VIEW in snmpd.conf to restrict/deny access to the
communityGroup. For example:
# The VIEW: qualifier further restricts access using the community
# name to the sub-set of the agent's supported MIB identified by
# the space list of "MIB view sub-trees". A view sub-tree may be
# either the object identifier (1.3.6.1.2.1.1) or object name
# (system) of the MIB sub-tree to be included. The '-' character
# may be used to exclude an oid/name from the view. For example,
#
# You can resolve this issue by adding a VIEW: qualifier to each
# line containing a get-community-name.
# The least restrictive VIEW: qualifier which denies access to the
# communityTable is:
get-community-name: yyyyyy VIEW: 1.3.6.1 -communityMIB
C. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:
Use your browser to get to the HP IT Resource Center page
at:
Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.
To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.
For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA"
The security patch matrix is also available via anonymous
ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".
D. To report new security vulnerabilities, send email to
security-alerthp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alerthp.com.
Permission is granted for copying and circulating this
Bulletin to Hewlett-Packard (HP) customers (or the Internet
community) for the purpose of alerting them to problems,
if and only if, the Bulletin is not edited or changed in
any way, is attributed to HP, and provided such reproduction
and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. HP is not
liable for any misuse of this information by any third party.
________________________________________________________________
-----End of Document ID: HPSBUX0208-208--------------------------------------
Document ID: HPSBUX0208-207
Date Loaded: 20020807
Title: Sec. Vulnerability in HP Apache Server PHP
TEXT
-----------------------------------------------------------------
HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0208-207
Originally issued: 08 August 2002
-----------------------------------------------------------------
The information in the following Security Bulletin should be acted
upon as soon as possible. Hewlett-Packard Company will not be
liable for any consequences to any customer resulting from
customer's failure to fully implement instructions in this Security
Bulletin as soon as possible.
------------------------------------------------------------------
PROBLEM: The potential exists for a remotely exploitable
vulnerability in the portion of PHP code responsible for
handling file uploads, specifically multipart/form-data.
PLATFORM: HP9000 Servers running HP-UX release 11.00, 11.11, 11.20,
and 11.22 with the HP Apache product installed.
DAMAGE: Potential for increased privilege, denial of service, or
execution of arbitrary code.
SOLUTION: Download new product bundles from
http://www.software.hp.com/ISS_products_list.html
MANUAL ACTIONS: Install product bundle.
AVAILABILITY: The new product bundles are available now.
------------------------------------------------------------------
A. Background
The CERT Advisory CA-2002-21 regarding PHP, affects the
following HP products:
B9415AA Apache 1.3.x HP-UX releases 11.00 and 11.11
B9416AA Apache 2.x HP-UX releases 11.00 and 11.11
B9415AA Apache 1.3.x HP-UX releases 11.20 and 11.22
B9416AA Apache 2.x HP-UX releases 11.20 and 11.22
B9416BA Apache 2.x IPv6 HP-UX release 11.11
Before updating, make sure to stop any previous HP Apache
binary. Otherwise, the previous binary will continue running,
preventing the new one from automatically starting, although
the installation would have been successful.
The command to stop the HP Apache binary is:
for 1.3.26:
/opt/apache/bin/apachectl stop
for 2.0.39:
/opt/hpapache2/bin/apachectl stop
HP Apache automatically starts upon installation if port 80
is available.
Installation of this new version of HP Apache over an existing
HP Apache installation is supported, while installation over a
non-HP Apache is NOT supported.
==================================================================
Case id: SSRT2300 - HP Tru64 UNIX, HP OpenVMS, and Internet
Express V5.9
o Secure Web Server for HP OpenVMS and HP Tru64 UNIX are not
vulnerable.
o Internet Express V5.9 contains PHP 4.1.2 which is not
listed as vulnerable to this problem. We also have provided
an externally downloadable Secure Web Server 5.9.1 kit (with
security fixes to Apache) that also contains PHP 4.1.2.
B. Fixing the problem
Note: OpenView Network Node Manager (NNM) customers should not
install these bundles. The version of Apache delivered
with NNM is under investigation. This bulletin will be
updated when more information is available.
The fixes for all versions are in the form of new product
bundles rather than patches.
Fixes for the following versions can be downloaded from
http://www.software.hp.com/ISS_products_list.html :
hp apache-based web server v.1.3.26.03
on hp-ux 11.0 and 11i (pa-risc)
hp apache-based web server v.1.3.26.03
on hp-ux 11i version 1.5 and 1.6 (ipf)
hp apache-based web server v.2.0.39.03
on hp-ux 11.0 and 11i (pa-risc)
hp apache-based web server v.2.0.39.03
on hp-ux 11i (pa-risc) for ipv6
hp apache-based web server v.2.0.39.03
on hp-ux 11i version 1.5 and 1.6 (ipf)
C. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:
Use your browser to get to the HP IT Resource Center page at:
Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.
To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.
For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA"
The security patch matrix is also available via anonymous
ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".
D. To report new security vulnerabilities, send email to
security-alerthp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alerthp.com.
Permission is granted for copying and circulating this
Bulletin to Hewlett-Packard (HP) customers (or the Internet
community) for the purpose of alerting them to problems,
if and only if, the Bulletin is not edited or changed in
any way, is attributed to HP, and provided such reproduction
and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. HP is not
liable for any misuse of this information by any third party.
________________________________________________________________
-----End of Document ID: HPSBUX0208-207--------------------------------------
Document ID: HPSBUX0207-197
Date Loaded: 20020701
Title: Sec. Vulnerability in Apache Server Chunk Encoding Rev 06
TEXT
-----------------------------------------------------------------
**REVISED 06**
HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0207-197
Originally issued: 01 July 2002
Last revision: 08 Aug 2002
-----------------------------------------------------------------
The information in the following Security Bulletin should be acted
upon as soon as possible. Hewlett-Packard Company will not be
liable for any consequences to any customer resulting from customer's
failure to fully implement instructions in this Security Bulletin as
soon as possible.
------------------------------------------------------------------
PROBLEM: A remotely exploitable potential for vulnerability in
handling of large data chunks in Apache-based web servers.
**REVISED 06**
PLATFORM: HP9000 Servers running HP-UX release 11.00, 11.04, 11.11
11.20, and 11.22 with the HP Apache product installed.
--->> affected OpenView Products:
--->> Network Node Manager (NNM) 6.01, 6.1, 6.2, 6.31
--->> running on HP-UX and Solaris
--->> NNM on Windows NT/W2K is not affected.
--->> OV Service Information Portal (OVSIP) 1.0, 2.0, 3.0
DAMAGE: Potential for increased privilege, denial of service, or
execution of arbitrary code.
**REVISED 06**
SOLUTION: For HP-UX releases 11.00, 11.11, 11.20 and 11.22 download
--->> new product bundles from
--->> http://www.software.hp.com/ISS_products_list.html
For only HP-UX release 11.04 (VV-OS): apply patches
PHSS_27361 - for VV 4.6 release,
PHSS_27371 - for VV 4.5 release.
--->> For OV NNM 6.2
--->> PHSS_27638 for HPUX 10.20
--->> PHSS_27639 for HPUX 11.X
--->> PSOV_03199 for SOLARIS 6,7,8
--->> patches for NNM6.01, 6.1, 6.31 are under investigation
--->> For OV SIP 3.0
--->> PHSS_27547 for HPUX 11.X
--->> Note: PHSS_27547 has been superseded by PHSS_27668.
--->> OVSIPSOL_00004 for SOLARIS 6,7,8
--->> Note: OVSIPSOL_00004 has been superseded
--->> by OVSIPSOL_00005.
--->> no patches are planned for OVSIP 1.0 and 2.0
MANUAL ACTIONS: Install repaired binary.
AVAILABILITY: Complete product bundles are available now for 11.00
and 11.11 are available for PA-RISC architecture
--->> are available from
--->> http://www.software.hp.com/ISS_products_list.html
HP-UX 11.04 (VV-OS) patches are available now at
itrc.hp.com
CHANGE SUMMARY: Rev.01 - Do not install the bundle on NNM.
Rev.02 - Added Virtualvault patches.
Rev.03 - Re-released 1.3.26 bits due to an update
deficiency and other minor problems.
Rev.04 - Added IPF versions.
Rev.05 - Added IPv6 PA-RISC version.
Rev.06 - Added affected OpenView Products,
revised location of Apache product
bundles.
------------------------------------------------------------------
A. Background
The CERT Advisory CA-2002-17 regarding Apache affects the
following HP products:
B9415AA Apache 1.3.x PA-RISC HP-UX releases 11.00 and 11.11
B9416AA Apache 2.x PA-RISC HP-UX releases 11.00 and 11.11
B9415AA Apache 1.3.x IPF HP-UX releases 11.20 and 11.22
B9416AA Apache 2.x IPF HP-UX releases 11.20 and 11.22
B9416BA Apache 2.x IPv6 PA_RISC HP-UX release 11.11
*** REVISED 06 ***
--->> OpenView NNM 6.01, 6.1, 6.2, 6.31 running on HPUX or SOLARIS
--->> OpenView SIP 1.0, 2.0, 3.0 running on HPUX or SOLARIS
HP Apache 1.3.26 (PA-RISC)
installs into /opt/apache and /opt/tomcat
disk space: 55-65 MB
documents: /opt/apache/htdocs/doc
HP Apache 2.0.39 (PA-RISC)
installs into /opt/hpapache2
disk space: 80-90 MB
documents: /opt/hpapache2/hp_apache_docs
HP Apache 1.3.26 (IPF)
installs into /opt/apache and /opt/tomcat
disk space: 65-75 MB
documents: /opt/apache/hp_apache_docs
HP Apache 2.0.39 (IPF)
installs into /opt/hpapache2
disk space: 80-90 MB
documents: /opt/hpapache2/hp_apache_docs
HP Apache 2.0.39 IP version 6 (PA-RISC)
installs into /opt/hpapache2
disk space: 80-90 MB
documents: /opt/hpapache2/hp_apache_docs
Before updating, make sure to stop your previous HP Apache
binary. Otherwise, the previous binary will continue running,
preventing the new one from automatically starting, although
the installation would have been successful.
The command to stop the HP Apache binary is:
For 1.3.26:
/opt/apache/bin/apachectl stop
For 2.0.39:
/opt/hpapache2/bin/apachectl stop
HP Apache automatically starts upon installation if port 80
is available.
Installation of this new version of HP Apache over an existing
HP Apache installation is supported, while installation over a
non-HP Apache is NOT supported.
==================================================================
An advisory has been issued for HP Compaq systems. Please
refer to HP Compaq SSRT2253, which says in part:
CSWS Secure Web Server for HP Tru64 UNIX and HP OpenVMS
"Potential Apache Web Server Chunk Handling Vulnerability"
Patches are available for CSWS for HP Tru64 UNIX at:
http://tru64unix.compaq.com/internet/download.htm#sws_v591
Patches are available for CSWS for HP OpenVMS at:
http://www.openvms.compaq.com/openvms/products/ips/apache/
+csws_patches.html
B. Fixing the problem
The Virtualvault product (also known as HP-UX 11.04) has
patches for its 4.5 and 4.6 releases. The patch for VV 4.6
updates the outside web server to the Apache 1.3.26 version
from the Apache 1.3.22 version shipped with the VV 4.6 release.
For the VV 4.5 patch, the security fix from the Apache 1.3.26
version was backported to the 1.3.19 version per the Apache
Group's patch for httpd 1.2.0-1.3.22.
Both of these Virtualvault patches are available in itrc.hp.com.
PHSS_27361 - for VV 4.6 release.
PHSS_27371 - for VV 4.5 release.
**REVISED 06**
--->> Fixes for the following versions can be downloaded from
--->> http://www.software.hp.com/ISS_products_list.html :
--->> hp apache-based web server v.1.3.26.03
--->> on hp-ux 11.0 and 11i (pa-risc)
--->> hp apache-based web server v.1.3.26.03
--->> on hp-ux 11i version 1.5 and 1.6 (ipf)
--->> hp apache-based web server v.2.0.39.03
--->> on hp-ux 11.0 and 11i (pa-risc)
--->> hp apache-based web server v.2.0.39.03
--->> on hp-ux 11i (pa-risc) for ipv6
--->> hp apache-based web server v.2.0.39.03
--->> on hp-ux 11i version 1.5 and 1.6 (ipf)
*** REVISED 06 ***
--->> OpenView NNM patches are now available
--->> For OV NNM 6.2
--->> PHSS_27638 for HPUX 10.20
--->> PHSS_27639 for HPUX 11.X
--->> PSOV_03199 for SOLARIS 6,7,8
--->> patches for NNM6.01, 6.1, 6.31 are under investigation
--->> OpenView SIP patches are now available
--->> For OV SIP 3.0
--->> PHSS_27547 for HPUX 11.X
--->> Note: PHSS_27547 has been superseded by PHSS_27668.
--->> OVSIPSOL_00004 for SOLARIS 6,7,8
--->> Note: OVSIPSOL_00004 has been superseded
--->> by OVSIPSOL_00005.
--->> no patches are planned for OVSIP 1.0 and 2.0
--->> OpenView patches can be downloaded from:
--->> http://support.openview.hp.com/cpe/patches
C. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:
Use your browser to get to the HP IT Resource Center page at:
Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.
To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.
For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA"
The security patch matrix is also available via anonymous
ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".
D. To report new security vulnerabilities, send email to
security-alerthp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alerthp.com.
Permission is granted for copying and circulating this
Bulletin to Hewlett-Packard (HP) customers (or the Internet
community) for the purpose of alerting them to problems,
if and only if, the Bulletin is not edited or changed in
any way, is attributed to HP, and provided such reproduction
and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. HP is not
liable for any misuse of this information by any third party.
________________________________________________________________
-----End of Document ID: HPSBUX0207-197--------------------------------------
Document ID: HPSBUX0202-184
Date Loaded: 20020212
Title: Sec. Vulnerability in SNMP (rev. 14)
TEXT
----------------------------------------------------------------
**REVISED 14** HEWLETT-PACKARD COMPANY SECURITY BULLETIN: #0184,
Originally issued: 12 Feb. 2002
Last revision: 08 Aug. 2002
----------------------------------------------------------------
The information in the following Security Bulletin should be acted
upon as soon as possible. Hewlett-Packard Company will not be
liable for any consequences to any customer resulting from customer's
failure to fully implement instructions in this Security Bulletin as
soon as possible.
------------------------------------------------------------------
PROBLEM: Vulnerabilities in SNMP request and trap handling.
PLATFORM: HP 9000 Series 700 and Series 800 running HP-UX
releases 10.X and 11.X
HP Procurve switches
HP TopTools Remote Control Card
JetDirect Firmware
MC/ServiceGuard, EMS HA Monitors
Solaris running OpenView or NNM
Windows/NT running OpenView or NNM
DAMAGE: Possible denial-of-service, service interruptions,
unauthorized access.
SOLUTION: Apply patches or implement workarounds. See below.
For HP-UX releases:
PHSS_26510 s700_800 HP-UX 10.10, 10.01 Emanate 14.0
PHSS_26137 s700_800 HP-UX 10.20 OV EMANATE14.2 Agent
PHSS_27181 s700_800 HP-UX 10.20 OV EMANATE14.2 Agent
PHSS_26367 s700_800 HP-UX 10.24 VirtualVault (VVOS)
PHSS_26138 s700_800 HP-UX 11.X OV EMANATE14.2 Agent
PHSS_27182 s700_800 HP-UX 11.X OV EMANATE14.2 Agent
PHSS_26368 s700_800 HP-UX 11.04 VirtualVault (VVOS)
PSOV_03087 Solaris 2.5.1, Solaris 2.6, Solaris 2.7
Solaris 2.8 EMANATE Release 14.2
PSOV_03162 Solaris 2.5.1, Solaris 2.6, Solaris 2.7
Solaris 2.8 EMANATE Release 14.2
PSOV_03113 Solaris 2.3, Solaris 2.4 Emanate Release 14.0
For systems running OV NNM install above SNMP
patches for HP-UX and Solaris in addition to the NNM
patches listed below.
For Windows/NT install:
NNM_00846 Windows NT4.0/4.01 Windows 2000
NNM_00909 Windows NT4.0/4.01 Windows 2000
NNM6.2
PHSS_26932 NNM 6.2 HP-UX 10.20
PHSS_26933 NNM 6.2 HP-UX 11.X
NNM_00890 NNM 6.2 Win NT/2k
PSOV_03144 NNM 6.2 Solaris 2.X
NNM6.1 Note: both patches are required.
PHSS_26918, PHSS_26908 NNM 6.1 HP-UX 10.20
PHSS_26919, PHSS_26909 NNM 6.1 HP-UX 11.X
NNM_00889, ECS_00011 NNM 6.1 Win NT/2k
PSOV_03143, PSOV_03142 NNM 6.1 Solaris 2.5,
2.6, 2.7, 2.8
NNM5.01
PHSS_26806 NNM 5.01 HP-UX 10.20
PSOV_03136 NNM 5.01 Solaris 2.X
NNM4.11
PHSS_26777 NNM 4.11 HP-UX 10.20
PSOV_03132 NNM 4.11 Solaris 2.X
OpenView Distributed Management 5.03
PHSS_27273 - HP-UX 10.X
PHSS_27274 - HP_UX 11.X
PSOV_03173 - Solaris 2.X
**REVISED 14**
--->> OpenView Distributed Management 6.0
--->> PHSS_27437 - HP-UX 10.X
--->> PHSS_27438 - HP_UX 11.X
--->> PSOV_03188 - Solaris 2.X
MANUAL ACTIONS: Upgrade or workaround action per below.
AVAILABILITY: Patches for some affected systems are available now.
CHANGE SUMMARY: Rev.01 affected HP Procurve scope expanded,
plus Procurve patch availability added.
NNM ovtrapd patch availability added.
Rev.02 SG and EMS found not vulnerable.
Rev.03 JetDirect vulnerability updated
Rev.04 NNM 5.X and VVOS patches, vulnerability note
for Solaris, and Windows NT.
Rev.05 VVOS patch ID typo.
Rev.06 Updating NNM 5.X section, HP OC SS7 added
Rev.07 Added OpenView product status list
Rev.08 Added NNM 5.01 and 4.11 patches for HP-UX
and Solaris
Rev.09 New NNM 6.1 and NNM 6.2 patches, additional
Emanate patches, and TopTools Remote
Control Card information
Rev.10 Additional Emanate and NNM patches.
Rev.11 PHSS_27181,PHSS_27182, are only found on:
http://support.openview.hp.com/cpe/patches/
Rev.12 OpenView Distributed Management 5.03
patches added. Added pointer to HP Compaq
security advisory.
Rev.13 Further expanded affected Procurve
switch scope.
Rev.14 Added OpenView Distributed Management 6.0
patches.
------------------------------------------------------------------
A. Background
CERT has issued an advisory:
CERT Advisory CA-2002-03 Multiple Vulnerabilities in Many
Implementations of the Simple Network Management Protocol
(SNMPv1) containing information about the vulnerabilities.
Hewlett-Packard Company will revise this bulletin as new
information becomes available.
---------------------------------------------------------
hp Procurve switches
---------------------------------------------------------
We have created fixes for products below which will resolve
these issues. See Section C below.
---------------------------------------------------------
HP TopTools Remote Control Card
---------------------------------------------------------
TopTools Remote Control (TTRC) card, rev. 2.0. (product P1218A)
has an SNMP MIB defect.
---------------------------------------------------------
NNM (Network Node Manager)
---------------------------------------------------------
Some problems found in NNM product were related to trap
handling. Patches are available. See Section C below.
---------------------------------------------------------
JetDirect Firmware
---------------------------------------------------------
JetDirect Firmware Version State
========================== =====
X.08.32 and lower VULNERABLE
(where X = A through K)
X.21.00 and higher NOT vulnerable
(where X = L through P)
----------------------------------------------------------
HP-UX Systems running snmpd or OpenView
----------------------------------------------------------
Any HP-UX 10.X or 11.X system running snmpd or snmpdm is
vulnerable. To determine if your HP-UX system has snmpd
or snmpdm installed:
swlist -l file | grep snmpd
----------------------------------------------------------
Other systems running OpenView or NNM
----------------------------------------------------------
Solaris and Windows/NT systems running OpenView or NNM
are vulnerable.
----------------------------------------------------------
OpenView Product Status
----------------------------------------------------------
NNM Vulnerable
Patches in process
Note:
Patches for NNM 6.2, NNM 6.1,
NNM 5.01, NNM 4.11, and Emanate
are complete.
Patches for NNM 5.02 and NNM 6.01
are in process.
NNM also ships Emanate SNMP Agents
so patches for Emanate SNMP Agents
should also be applied (See section
"C. Recommended solution" below).
----------------------------------------------------------
ITO/VPO/OVO on Vulnerable
Unix Patches in process
Note:
This product bundles the NNM and
Emanate Agents with it. Appropriate
NNM and Emanate Agent patches should
also be applied. (See section
"C. Recommended solution" below).
----------------------------------------------------------
OVO Windows Under Investigation
VPW/OVO Windows Note:
OVO bundles the NNM and Emanate
Agents with it. Appropriate NNM and
Emanate agent patches should also be
applied. (See section
"C. Recommended solution" below).
----------------------------------------------------------
Extensible Agent Vulnerable
(EA) Patches released
HP-UX 10.01, 10.10
- PHSS_26510
HP-UX 10.20 - PHSS_26137
HP-UX 11.0 - PHSS_26138
Solaris 2.5.1, 2.6, 2.7, 2.8
- PSOV_03087
Solaris 2.3, 2.4
- PSOV_03113
----------------------------------------------------------
Emanate SNMP Agents Vulnerable
Patches released:
HP-UX 10.01, 10.10 - PHSS_26510
HP-UX 10.20 - PHSS_26137, PHSS_27181
HP-UX 11.X - PHSS_26138, PHSS_27182
Solaris 2.5.1, 2.6, 2.7, 2.8
- PSOV_03087, PSOV_03162
Solaris 2.3, 2.4
- PSOV_03113
NT - NNM_00846, NNM_00909
----------------------------------------------------------
SAM builder Under Investigation
----------------------------------------------------------
SAM allocator Under Investigation
----------------------------------------------------------
SAM accountant Under Investigation
----------------------------------------------------------
SAM optimizer Under Investigation
----------------------------------------------------------
SAM SNM Under Investigation
----------------------------------------------------------
SA (Service Assurance) Under Investigation
----------------------------------------------------------
OEMF Under Investigation
----------------------------------------------------------
**REVISED 14**
DM DM Release 5.03 Vulnerable.
Patches released:
PHSS_27273 - HP-UX 10.X
PHSS_27274 - HP_UX 11.X
PSOV_03173 - Solaris 2.X
--->> DM Release 6.0 Vulnerable.
--->> Patches released:
--->> PHSS_27437 - HP-UX 10.X
--->> PHSS_27438 - HP_UX 11.X
--->> PSOV_03188 - Solaris 2.X
----------------------------------------------------------
Note: An HP Compaq security advisory (SSRT0799) is available
at http://ftp.support.compaq.com/patches/.new/security.shtml
B. Fixing the problem
Install the appropriate patch or firmware revision or work
around problem as detailed below.
C. Recommended solution
---------------------------------------------------------
hp Procurve switches
---------------------------------------------------------
Customers can download these patches in the form of software
upgrades at:
http://www.hp.com/rnd/software/switches.htm
Product Fix revision number
----------------------------------- -------------------
HP Procurve Switch 2524 (J4813A) F.04.08 or greater
HP Procurve Switch 2512 (J4812A) F.04.08 or greater
HP Procurve Switch 4108GL (J4865A) G.04.05 or greater
HP Procurve Switch 4108GL-bundle (J4861A) G.04.05 or greater
HP Procurve Switch 1600M (J4120A) C.09.13 or Greater
HP Procurve Switch 2400M (J4120A) C.09.13 or Greater
HP Procurve Switch 2424M (J4122A) C.09.13 or Greater
HP Procurve Switch 4000M (J4121A) C.09.13 or Greater
HP Procurve Switch 8000M (J4110A) C.09.13 or Greater
---------------------------------------------------------
NNM (Network Node Manager)
---------------------------------------------------------
Problems found in the NNM 6.1 and NNM 6.2 products are
addressed in patches available at:
http://support.openview.hp.com/cpe/patches/nnm/
Note: The NNM 6.2 patches listed in previous revisions
of this bulletin only addressed trap handling. The
following patches address all NNM 6.2 vulnerabilities.
PHSS_26932 s700_800 HP-UX 10.20 all fixes
PHSS_26933 s700_800 HP-UX 11.X all fixes
PSOV_03144 Solaris 2.X all fixes
NNM_00890 NT 4.X/Windows 2000 all fixes
PHSS_26918, PHSS_26908 NNM 6.1 HP-UX 10.20
PHSS_26919, PHSS_26909 NNM 6.1 HP-UX 11.X
NNM_00889, ECS_00011 NNM 6.1 Win NT/2k
PSOV_03143, PSOV_03142 NNM 6.1 Solaris 2.5,
2.6, 2.7, 2.8
Note: For NNM 6.1 both patches are required.
For NNM 5.01, and 4.11 (HP-UX and Solaris versions only) see
the list below, and obtain the patches from:
http://support.openview.hp.com/cpe/patches/nnm/nnm.jsp
NNM 5.01
--------
HP-UX 10.20 PHSS_26806
Solaris 2.X PSOV_03136
NNM 4.11
--------
HP-UX 10.20 PHSS_26777
Solaris 2.X PSOV_03132
Patches for NNM 5.02 and NNM 6.01 are in process.
This bulletin will be updated when new patches are available.
---------------------------------------------------------
DM (OpenView Distributed Management)
---------------------------------------------------------
**REVISED 14**
Problems found in the OpenView Distributed Management 5.03
--->>and OpenView Distributed Management 6.0
are addressed in patches available at:
http://support.openview.hp.com/cpe/patches/nnm/
OpenView Distributed Management 5.03
PHSS_27273 - HP-UX 10.X
PHSS_27274 - HP_UX 11.X
PSOV_03173 - Solaris 2.X
--->> OpenView Distributed Management 6.0
--->> PHSS_27437 - HP-UX 10.X
--->> PHSS_27438 - HP_UX 11.X
--->> PSOV_03188 - Solaris 2.X
---------------------------------------------------------
MC/ServiceGuard
---------------------------------------------------------
MC/ServiceGuard is not affected. Testing has been completed
and neither MC/ServiceGuard nor ServiceGuard OPS Edition are
negatively impacted.
The ServiceGuard Manager product does not use the cluster
SNMP and remains unaffected.
---------------------------------------------------------
Event Monitoring System (EMS)
---------------------------------------------------------
Testing of the MC/ServiceGuard or ServiceGuard OPS Edition
application with package resources defined using EMS High
Availability Monitors has been completed and shows no
vulnerability to this issue.
---------------------------------------------------------
HP TopTools Remote Control Card
---------------------------------------------------------
TopTools Remote Control (TTRC) card, rev. 2.0. (product P1218A)
has an SNMP MIB defect. This is fixed in firmware version
B.03.02 available at:
http://h20004.www2.hp.com/keeper_rnotes/bsdmatrix/matrix62319.html
---------------------------------------------------------
JetDirect Firmware
---------------------------------------------------------
JetDirect Firmware Version State
========================== =====
X.08.32 and lower VULNERABLE
(where X = A through K)
X.21.00 and higher NOT vulnerable
(where X = L through P)
FIX STATUS: HP is working on a firmware fix.
WORKAROUND: Change the set-community-name and use the
Access Control List as described in "HP JetDirect Print
Servers - Making HP JetDirect Print Servers Secure on
the Network":
http://www.hp.com/cposupport/networking/support_doc/
bpj05999.html#P88_10129
LIMITING THE VULNERABILITY
SNMPv1 security relies on the set community name. It is
important that a set-community-name be configured on the
JetDirect device and that it be kept secret.
JetDirect Print Servers offer an Access Control List that
can be used to specify which hosts can make SNMP
configuration changes to JetDirect Print Servers.
The steps above can help prevent exploitation of the
vulnerability. To eliminate the vulnerability before a fix
is available SNMP can be disabled on the JetDirect device.
DISABLING SNMP ON A JETDIRECT PRINT SERVER
1. Update the firmware to the highest level as described in
the JetDirect Upgrade Instructions document:
http://www.hp.com/cposupport/networking/support_doc/bpj06917.html
NOTE: Disabling SNMP may affect device discovery and port
monitors that use SNMP to get status on the device.
Use this feature with care.
2. Telnet to the JetDirect device (on the latest firmware)
and type:
snmp-config: 0
quit
This will completely disable SNMP on the JetDirect device.
HP always recommends upgrading JetDirect firmware for the
latest bug fixes and security benefits. The upgrade firmware
and download utility are available free of charge:
http://www.hp.com/cposupport/networking/support_doc/bpj06917.html
The following is a list of JetDirect Product Numbers
that can be freely upgraded to X.08.32 or X.21.00 or
higher firmware. The latest firmware revision available
for download is given. For example, the latest firmware
revision for the J3110A is G.08.32.
EIO (Peripherals LaserJet 4000, 5000, 8000, etc...)
J3110A 10T [G.08.32]
J3111A 10T/10B2/LocalTalk [G.08.32]
J3112A Token Ring (discontinued) [G.08.32]
J3113A 10/100 (discontinued) [G.08.32]
J4169A 10/100 [L.21.22]
J4167A Token Ring [L.21.25]
J6057A 10/100 [R.22.09]
MIO (Peripherals LaserJet 4, 4si, 5si, etc...)
J2550A/B 10T (discontinued) [A.08.32]
J2552A/B 10T/10Base2/LocalTalk (discontinued) [A.08.32]
J2555A/B Token Ring (discontinued) [A.08.32]
J4100A 10/100 [K.08.32]
J4105A Token Ring [K.08.32]
J4106A 10T [K.08.32]
LIO (Peripherals Color InkJet cp1160, cp1700)
J6042A 250m 10/100 [N.21.22]
External Print Servers
J2591A EX+ (discontinued) [E.08.32]
J2593A EX+3 10T/10B2 (discontinued) [D.08.32]
J2594A EX+3 Token Ring (discontinued) [D.08.32]
J3263A 300X 10/100 [H.08.32]
J3264A 500X Token Ring [J.08.32]
J3265A 500X 10/100 [J.08.32]
J6038A 310x USB 10/100 [Q.22.04]
----------------------------------------------------------
HP-UX Systems running snmpd or OpenView
----------------------------------------------------------
The following patches are available now:
PHSS_26510 s700_800 HP-UX 10.10, 10.01 Emanate 14.0
PHSS_26137 s700_800 HP-UX 10.20 OV EMANATE14.2 Agent
PHSS_27181 s700_800 HP-UX 10.20 OV EMANATE14.2 Agent
PHSS_26367 s700_800 HP-UX 10.24 VirtualVault (VVOS)
PHSS_26138 s700_800 HP-UX 11.X OV EMANATE14.2 Agent
PHSS_27182 s700_800 HP-UX 11.X OV EMANATE14.2 Agent
PHSS_26368 s700_800 HP-UX 11.04 VirtualVault (VVOS)
PSOV_03087 Solaris 2.5.1, Solaris 2.6, Solaris 2.7
Solaris 2.8 EMANATE Release 14.2
PSOV_03162 Solaris 2.5.1, Solaris 2.6, Solaris 2.7
Solaris 2.8 EMANATE Release 14.2
PSOV_03113 Solaris 2.3, Solaris 2.4 Emanate Release 14.0
For systems running OV NNM install above SNMP
patches for HP-UX and Solaris.
For Windows/NT install:
NNM_00846 Windows NT4.0/4.01 Windows 2000
NNM_00909 Windows NT4.0/4.01 Windows 2000
PSOV_03087, PSOV_0162, NNM_00846, NNM_00909, PSOV_03113,
PHSS_27181, PHSS_27182 are available from:
http://support.openview.hp.com/cpe/patches/
PHSS_26367 and PHSS_26368 available from:
http://itrc.hp.com
PHSS_26510, PHSS_26137, and PHSS_26138 are available
from both sites.
The HP OC SS7 (OpenCall) products J3362A and J5938A running
on HP-UX releases 10.20 and 11.X are not vulnerable if the
applicable HP-UX patch listed above is installed.
============================================================
NOTE: The patches are labeled OV (OpenView). However, the
patches are also applicable to systems that are _NOT_
running OpenView.
============================================================
Workaround for HP-UX Systems:
If a patch is not available for your platform or you cannot
install an available patch, snmpd and snmpdm can be disabled
by removing their entries from /etc/services and removing the
execute permissions from /usr/sbin/snmpd and /usr/sbin/snmpdm.
D. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:
Use your browser to get to the HP IT Resource Center page at:
Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.
To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.
For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA"
The security patch matrix is also available via anonymous
ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".
E. To report new security vulnerabilities, send email to
security-alerthp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alerthp.com.
Permission is granted for copying and circulating this
Bulletin to Hewlett-Packard (HP) customers (or the Internet
community) for the purpose of alerting them to problems,
if and only if, the Bulletin is not edited or changed in
any way, is attributed to HP, and provided such reproduction
and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. HP is not
liable for any misuse of this information by any third party.
________________________________________________________________
-----End of Document ID: HPSBUX0202-184--------------------------------------
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]