|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
HP-UX security bulletins digest
From: IT Resource Center (support_feedback
us-support2-mail.external.hp.com)
Date: Tue Apr 15 2003 - 08:31:42 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
HP Support Information Digests
===============================================================================
o Security Bulletin Digest Split
------------------------------
The security bulletins digest has been split into multiple digests
based on the operating system (HP-UX, MPE/iX, and HP Secure OS
Software for Linux). You will continue to receive all security
bulletin digests unless you choose to update your subscriptions.
To update your subscriptions, use your browser to access the
IT Resource Center on the World Wide Web at:
http://support.itrc.hp.com/
Under the Maintenance and Support Menu, click on the "more..." link.
Then use the 'login' link at the left side of the screen to login
using your IT Resource Center User ID and Password.
Under the notifications section (near the bottom of the page), select
Support Information Digests.
To subscribe or unsubscribe to a specific security bulletin digest,
select or unselect the checkbox beside it. Then click the
"Update Subscriptions" button at the bottom of the page.
o IT Resource Center World Wide Web Service
---------------------------------------------------
If you subscribed through the IT Resource Center and would
like to be REMOVED from this mailing list, access the
IT Resource Center on the World Wide Web at:
http://support.itrc.hp.com/
Login using your IT Resource Center User ID and Password.
Then select Support Information Digests (located under
Maintenance and Support). You may then unsubscribe from the
appropriate digest.
===============================================================================
Digest Name: daily HP-UX security bulletins digest
Created: Tue Apr 15 6:00:02 EDT 2003
Table of Contents:
Document ID Title
--------------- -----------
HPSBUX0304-253 SSRT3531 Potential Security Vulnerability in sendmail (rev.2)
HPSBUX0209-218 SSRT2345 Security Vulnerability in DNS Resolvers for HP Periph
HPSBUX0208-212 SSRT2328 Security Vulnerability in OpenSSL for JetDirect (rev.
HPSBUX0208-209 SSRT2316 Sec. Vulnerability in DNS and resolver lib's (rev.10)
The documents are listed below.
-------------------------------------------------------------------------------
Document ID: HPSBUX0304-253
Date Loaded: 20030414
Title: SSRT3531 Potential Security Vulnerability in sendmail (rev.2)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
-----------------------------------------------------------------
**REVISED 02**
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0304-253
Originally issued: 03 April 2003
Last revised: 14 April 2003
SSRT3531 Potential Security Vulnerability in sendmail (rev.2)
-----------------------------------------------------------------
NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.
The information in the following Security Bulletin should be
acted upon as soon as possible. Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.
-----------------------------------------------------------------
PROBLEM: Potential security vulnerability in sendmail
IMPACT: Potential unauthorized Privileged Access,
Potential Denial of Service (DoS).
PLATFORM: HP 9000 Series 700/800 Servers running HP-UX 10.10,
10.20, 11.00, 11.04(VVOS), 11.11, and 11.22.
SOLUTION: Download and install the appropriate files or the
HPSecurityBul253.depot.
The sendmail files and HPSecurityBul253.depot
referenced in HPSBUX0304-253 also address the
issues documented in HPSBUX0302-246.
If the sendmail files or HPSecurityBul253.depot
from HPSBUX0304-253 are installed, it is not necessary
to install the sendmail files or HPSecurityBul246.depot
from HPSBUX0302-246.
If both sets of sendmail files, or both depots, are
installed, the sendmail files or HPSecurityBul253.depot
from HPSBUX0304-253 must be installed *AFTER* the
sendmail files or HPSecurityBul246.depot from HP
HPSBUX0302-246 in order to ensure all issues are
addressed.
MANUAL ACTIONS: Yes - NonUpdate
Download and install the appropriate
sendmail file.
**REVISED 02**
AVAILABILITY: Fixes are available for 10.10, 10.20, 11.00,
11.04(VVOS), 11.11, and 11.22.
CHANGE SUMMARY: Rev.01 - Added fix for 11.22.
Added HPSecurityBul253.depot.
CHANGE SUMMARY: Rev.02 - Corrected filename:
/usr/newconfig/etc/mail/sendmail.cf
Added sendmail.886.10.10.r1.
-----------------------------------------------------------------
A. Background
A potential security vulnerability with sendmail has been
reported in HP-UX. This potential vulnerability may result
in unauthorized Privileged Access or a Denial of Service
(DoS). This potential vulnerability may be exploited
remotely.
This is the vulnerability reported in CERT/CC CA-2003-12.
Note: In order to provide fixes as soon as possible manually
installed files are being provided initially. A depot
and patches containing these files will be provided as
soon as they can be created.
A depot (HPSecurityBul253.depot) is now available.
Note: This problem also affects:
HP Tru64 UNIX/TruCluster Server V4.x and V5.x
HP Tru64 UNIX Engineering continues to work this
issue at the highest priority.
As solution information becomes available HP
will provide notice of the availability of any
necessary patches through standard security
bulletin announcements and be available from your
normal HP Services support channel.
The HP Tru64 bulletin will be posted to the customer
support website within 24 hours of release to -
http://thenew.hp.com/country/us/eng/support.html
or www.hp.com
Use the SEARCH IN feature box, enter SSRT in the
search window or use a specific SSRT #
(example: SSRT3531)
HP ProLiant Servers
If running Open Source Sendmail, refer to the following
Sendmail Consortium URL for patch details or upgrades:
http://www.sendmail.org
As more information becomes available HP
will provide notice of the availability of any
necessary patches through standard security
bulletin announcements and be available from your
normal HP Services support channel.
NOT VULNERABLE:
HP NonStop Servers
HP OpenVMS.
B. Recommended solution
Note: The fixes mentioned here include the fix for
for HPSBUX0302-246. The files are named to be
consistent with the names used in HPSBUX0302-246.
For example, HPSBUX0302-246 provided
sendmail.811.11.11.r1. This bulletin provides
sendmail.811.11.11.r2.
All versions of sendmail provided by HP on HP-UX
10.X and 11.X are vulnerable unless one of the
fixes described below has been installed.
Note: All the files mentioned for download below are
available from the following ftp site:
System: hprc.external.hp.com (192.170.19.51)
Login: sendmail
Password: sendmail
FTP Access: ftp://sendmail:sendmailhprc.external.hp.com/
or: ftp://sendmail:sendmail192.170.19.51/
or: ftp hprc.external.hp.com
Note: There is an ftp defect in IE5 that may result in
a browser hang. To work around this:
- Select Tools -> Internet Options -> Advanced
- Un-check the option:
[ ] Enable folder view for FTP sites
==================================================
To fix the problem:
1. Determine the sendmail version.
2. If necessary upgrade to a version of sendmail
for which a fix is available. Existing 8.11.1
versions MUST be updated to the versions listed
below or subsequent.
3. Modify sendmail.cf.
EITHER
4. Download and install HPSecurityBul253.depot.gz.
OR
5. Download and install the appropriate sendmail
and killsm files.
**REVISED 02**
--> Note: sendmail.886.10.10.r1 is not in the depot at
--> this time. The file must be installed
--> as described in step 5.
Details:
1. Determine the sendmail version.
Login in as root:
cd /usr/sbin
sendmail -d0.1 < /dev/null | grep -i version
The display will show Version #.#.#
2. If necessary upgrade to a version of sendmail
for which a fix is available.
Fixes are available for the following versions:
**REVISED 02**
--> HP-UX 10.10: sendmail 8.8.6
HP-UX 10.20: sendmail 8.9.3
HP-UX 11.00: sendmail 8.11.1
HP-UX 11.00: sendmail 8.9.3
VVOS 11.04: sendmail 8.9.3
HP-UX 11.11: sendmail 8.11.1
HP-UX 11.11: sendmail 8.9.3
HP-UX 11.22: sendmail 8.11.1
Note: Existing sendmail 8.11.1 on 11.00 and 11.11
MUST be updated to the versions listed below.
If you are not running one the those versions,
you will need to upgrade as follows:
**REVISED 02**
--> HP-UX 10.10
-->
--> Upgrade to 8.8.6 by installing the web upgrade
--> available on:
--> http://www.software.hp.com/products/
--> Sendmail/index.html
--> This is a direct link to the 8.8.6 upgrade.
HP-UX 10.20
Upgrade to 8.9.3 by installing PHNE_25183.
HP-UX 11.00
Upgrade to 8.9.3 by by installing PHNE_24419.
OR
Upgrade to 8.11.1 by installing the web upgrade
available on http://www.software.hp.com
Sendmail 8.11.1 Version 2 (B.11.00.01.002) released in March 2003
VVOS 11.04 (Virtual Vault Operating System):
Upgrade to 8.9.3 by installing PHNE_25984.
Note: VVOS does not support the web upgrade version
of sendmail 8.11.1.
HP-UX 11.11
Upgrade to 8.11.1 by installing the web upgrade
available on http://www.software.hp.com
Sendmail 8.11.1 Version 3 (B.11.11.01.003) released in March 2003
3. Modify sendmail.cf
Add "restrictqrun" to the PrivacyOptions.
After the change the line should read:
O PrivacyOptions=authwarnings,restrictqrun
**REVISED 02**
This change has already been made in the
--> /usr/newconfig/etc/mail/sendmail.cf file delivered with
the new 8.11.1.
For 8.9.3 the change must be made in the
--> /usr/newconfig/etc/mail/sendmail.cf file.
For both 8.9.3 and 8.11.1 the change must be made in
the /etc/mail/sendmail.cf file.
Note: Perform either step 4 or step 5.
--> Note: sendmail.886.10.10.r1 is not in the depot at
--> this time. The file must be installed
--> as described in step 5.
4. Download and install HPSecurityBul253.depot.gz:
a. Download HPSecurityBul253.depot.gz
b. Unpack the file with gunzip(1)
c. Verify the cksum or the md5 sum.
cksum HPSecurityBul253.depot
3387599586 6860800 HPSecurityBul253.depot
md5 HPSecurityBul253.depot
MD5 (HPSecurityBul253.depot) =
d5019256abfa93e034eeccc319df11ef
d. Extract the "readme" file for further information:
cd directory_containing_depot
swlist -d -l product -a readme
$PWD/HPSecurityBul253.depot
e. Install HPSecurityBul253.depot with swinstall(1).
5. Download and install the appropriate file.
a. Download the appropriate file(s).
**REVISED 02**
--> For HP-UX 10.10: sendmail.886.10.10.r1.gz for 8.8.6
For HP-UX 10.20: sendmail.893.10.20.r1.gz for 8.9.3
killsm.893.10.20 for 8.9.3
For HP-UX 11.00: sendmail.811.11.00.r1.gz for 8.11.1
sendmail.893.11.00.r1.gz for 8.9.3
killsm.893.11.00 for 8.9.3
For HP-UX 11.04: sendmail.893.11.00.r1.gz for 8.9.3
killsm.893.11.00 for 8.9.3
For HP-UX 11.11: sendmail.811.11.11.r2.gz for 8.11.1
sendmail.893.11.11.r1.gz for 8.9.3
killsm.893.11.11 for 8.9.3
For HP-UX 11.22: sendmail.811.11.22.r1.gz for 8.11.1
killsm.811.11.22 for 8.11.1
Note: Because of changes to sendmail a new version of
killsm is required. The new version is included
in the latest web upgrade for 8.11.1 on 11.00 amd
11.11. Since there is no web upgrade for 8.11.1
on 11.22, the killsm.811.11.22 is needed.
b. Unpack the file with gunzip(1)
c. Verify the cksum or the md5 sum.
**REVISED 02**
--> 2985469994 401408 sendmail.886.10.10.r1
2336630777 811008 sendmail.893.10.20.r1
3989146179 1042 killsm.893.10.20
342459522 831488 sendmail.893.11.00.r1
2688504642 1052 killsm.893.11.00
3227626308 970752 sendmail.811.11.00.r1
3541980035 864256 sendmail.893.11.11.r1
651707972 1053 killsm.893.11.11
3137083796 1015808 sendmail.811.11.11.r2
23403750 2312460 sendmail.811.11.22.r1
3188566214 1191 killsm.811.11.22
Note: If you wish to verify the md5 sum and you do not
have a copy of md5, please refer to:
HPSBUX9408-016
Patch sums and the MD5 program
Note: Using your itrc account security bulletins can be
found here:
http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin
**REVISED 02**
-->MD5 (sendmail.886.10.10.r1) = 484daf04bf70246459ce73317a8617b3
MD5 (sendmail.893.10.20.r1) = 6fdfd434b5a1c90907dc1149f8e7e5b2
MD5 (killsm.893.10.20) = 8aebbdb41ee527d8bae398a5feda82dd
MD5 (sendmail.893.11.00.r1) = ae011668557a64d93d5b683380332b8d
MD5 (killsm.893.11.00) = 4eb6f978de78540790487931b8f43eb1
MD5 (sendmail.811.11.00.r1) = 99b9c6f895fef1b923500df158f01678
MD5 (sendmail.893.11.11.r1) = 3be01a159408fa1090d1f7aafe822c88
MD5 (killsm.893.11.11) = a2c24f912bcf84ffb9dbb92620cac020
MD5 (sendmail.811.11.11.r2) = afe970b69d99a73faf7808917115f11f
MD5 (sendmail.811.11.22.r1) = dbae99173b44bc5b9698a009456345af
MD5 (killsm.811.11.22) = 3f456a09a76692fb0e77fe2cdb38e5f7
d. Install the appropriate file as follows:
Copy the appropriate sendmail file to a protected directory
such as /usr/sbin. If you are running sendmail 8.9.3 also
copy the appropriate killsm file to a protected directory
such as /usr/sbin.
Login as root and run killsm:
killsm
Verify the sendmail daemon is not running:
ps -ef | grep sendmail
If you are running the 8.9.3 version of sendmail
replace killsm as follows:
cd /usr/sbin
cp killsm killsm.orig
cp killrm.893.10.20 killsm
OR
cp killrm.893.11.00 killsm
OR
cp killrm.893.11.11 killsm
If you are runnimg 11.22:
cd /usr/sbin
cp killsm killsm.orig
cp killrm.811.11.22 killsm
For all versions of sendmail,
make a backup copy of the existing sendmail:
cd /usr/sbin
cp sendmail sendmail.original
Note the permissions for reference:
ls -lia /usr/sbin/sendmail
Install the new sendmail:
cp sendmail.xxx.yy.zz.rn sendmail
For example, on 11.11:
cp sendmail.811.11.11.r2 sendmail
Restart sendmail.
If you were running sendmail before the killsm
command above, you can now restart it with the
following command (for HP-UX, not VVOS):
/sbin/init.d/sendmail start
Note: Do not execute the command above for VVOS 11.04
The command runs sendmail as a daemon, which is
not supported by VVOS (Virtual Vault Operating
System).
End of Step 5.
==================================================
Note: If you receive either of the following messages after
applying the fix, please follow the recommended action.
warning: /etc/mail/aliases has world read or
write permission. This is unsafe.
warning: /etc/mail/aliases.db has world read or
write permission. This is unsafe.
Recommended action
Execute the following commands.
chmod 640 /etc/mail/aliases
chmod 640 /etc/mail/aliases.db
sendmail -bi
C. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:
Use your browser to get to the HP IT Resource Center page
at:
http://itrc.hp.com
Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.
NOTE: Using your itrc account security bulletins can be
found here:
http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin
To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.
For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA
The security patch matrix is also available via anonymous
ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".
The PGP key used to sign this bulletin is available from
several PGP Public Key servers. The key identification
information is:
2D2A7D59
HP Security Response Team (Security Bulletin signing only)
<security-alerthp.com>
Fingerprint =
6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59
If you have problems locating the key please write to
security-alerthp.com. Please note that this key is
for signing bulletins only and is not the key returned
by sending 'get key' to security-alerthp.com.
D. To report new security vulnerabilities, send email to
security-alerthp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alerthp.com.
-----------------------------------------------------------------
(c)Copyright 2003 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical or
editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of HP products referenced
herein are trademarks and/or service marks of Hewlett-Packard
Company. Other product and company names mentioned herein may be
trademarks and/or service marks of their respective owners.
_________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Security 7.0.3
iQA/AwUBPpsfdOAfOvwtKn1ZEQLqaACcCDklQNahgGrbYsEpF4TTuKZbq6kAn2Zx
2Ui0wGSudSA23vODLVn/v2eu
=wPD5
-----END PGP SIGNATURE-----
-----End of Document ID: HPSBUX0304-253--------------------------------------
Document ID: HPSBUX0209-218
Date Loaded: 20030414
Title: SSRT2345 Security Vulnerability in DNS Resolvers for HP Peripherals (rev.1)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
----------------------------------------------------------------
**REVISED 01**
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0209-218
Originally issued: 18 September 2002
Last Revised: 14 April 2003
SSRT2345 Security Vulnerability in DNS Resolvers
for HP Peripherals (rev.1)
-----------------------------------------------------------------
NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.
The information in the following Security Bulletin should be
acted upon as soon as possible. Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.
-----------------------------------------------------------------
PROBLEM: Multiple potential vulnerabilities in DNS Resolver
Libraries
PLATFORM: HP Jetdirect Print Servers, HP LaserJet Printers
IMPACT: Potential denial of service, potential unauthorized access
**REVISED 01**
SOLUTION: Upgrade the firmware to X.24.06 or subsequent (where
X is a character from L to Z). If it is not possible
to upgrade the firmware, eliminate the DNS server's IP
address or use specific IP addresses rather than DNS
names.
**REVISED 01**
MANUAL ACTIONS: Non-HP-UX only
Upgrade the firmware or change the DNS
configuration as documented below.
CHANGE SUMMARY: Rev.1 - firmware available
**REVISED 01**
AVAILABILITY: The firmware is available now.
-----------------------------------------------------------------
A. Background
CERT (Computer Emergency Response Team) has recently posted
an alert regarding DNS Resolver vulnerabilities in many
network devices that implement a DNS Resolver.
http://www.cert.org/advisories/CA-2002-19.html
The following HP Jetdirect devices are vulnerable:
--------------------------------------------------
Upgradable Print Servers
615n J6057A EIO 10/100 Print Server
610n J4169A EIO 10/100 Print Server
610n J4167A EIO 802.5 Print Server
680n J6058A EIO 802.11b Print Server
380x J6061A External 802.11b Print Server
310x J6038A External 10/100 Print Server
250m J6042A LIO 10/100 Print Server
Non-Upgradable Print Servers
175x J6035A External 10/100 Print Server
200m J6039A LIO 10/100 Print Server
The following HP Peripherals are vulnerable:
--------------------------------------------
HP Color LaserJet 4550
HP Color LaserJet 4600
HP LaserJet 4100, 4100MFP
HP LaserJet 9000, 9000MFP
HP Digital Sender 9100C
B. Recommended solution
**REVISED 01**
For HP Jetdirect Print Servers (Upgradable)
-->Upgrade the firmware to X.24.06 or subsequent
--> (where X is a character from L to Z).
Please refer to the following for more information:
Upgrading Jetdirect Firmware
============================
1. Via the HP Download Manager
http://h20000.www2.hp.com/bizsupport/TechSupport/
Document.jsp?objectID=bpj06917
2. Via Web Jetadmin
http://h20000.www2.hp.com/bizsupport/TechSupport/
Document.jsp?objectID=bpj06529
Making Jetdirect Print Servers Secure on the Network
====================================================
http://h20000.www2.hp.com/bizsupport/TechSupport/
Document.jsp?objectID=bpj05999
Using the HP Jetdirect Embedded Web Server Security Wizard
==========================================================
http://h20000.www2.hp.com/bizsupport/TechSupport/
Document.jsp?objectID=bpj07576
For HP Jetdirect Print servers (Not Upgradable)
1) If connected to a scanner, a scan-to-email function is
available. The email address of the SMTP server should
be entered as an IP address rather than a DNS name.
a) To modify the email address of the SMTP server access
Jetdirect's web server.
b) Click the "Networking" tab, then click "Other Settings".
c) The Email Server can be specified as an IP Address.
Then click "Apply".
2) If scan-to-email is not being used, the DNS resolver
is not being used. However, the steps above can be
implemented in anticipation of adding a scanner.
HP Peripherals
NOTE: The HP Peripherals listed implement a separate resolver
from Jetdirect.
These peripherals are not upgradable. Please utilize IP
addresses rather than DNS names for any email notifications
or other functionality that would require a DNS resolver.
To learn more about securing Jetdirect Print Servers on
the network please refer to this document:
http://www.hp.com/cposupport/networking/support_doc/
bpj05999.html#P26_2431
C. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:
Use your browser to get to the HP IT Resource Center page
at:
http://itrc.hp.com
Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.
NOTE: Using your itrc account security bulletins can be
found here:
http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin
To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems. Please note that installing the patches
listed in the Security Patch Matrix will completely
implement a security bulletin _only_ if the MANUAL ACTIONS
field specifies "No."
The Security Patch Check tool can verify that a security
bulletin has been implemented on HP-UX 11.XX systems providing
that the fix is completely implemented in a patch with no
manual actions required. The Security Patch Check tool cannot
verify fixes implemented via a product upgrade.
For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA
The security patch matrix is also available via anonymous
ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".
The PGP key used to sign this bulletin is available from
several PGP Public Key servers. The key identification
information is:
2D2A7D59
HP Security Response Team (Security Bulletin signing only)
<security-alerthp.com>
Fingerprint =
6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59
If you have problems locating the key please write to
security-alerthp.com. Please note that this key is
for signing bulletins only and is not the key returned
by sending 'get key' to security-alerthp.com.
D. To report new security vulnerabilities, send email to
security-alerthp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alerthp.com.
-----------------------------------------------------------------
(c)Copyright 2003 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical or
editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of HP products referenced
herein are trademarks and/or service marks of Hewlett-Packard
Company. Other product and company names mentioned herein may be
trademarks and/or service marks of their respective owners.
________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Security 7.0.3
iQA/AwUBPpsa8+AfOvwtKn1ZEQJqKwCeLL1CS+I1rM8jptWzSpl6sr2tFmEAniAW
qVLAQkwtfx7kS5hFVIeFcG5a
=tXDp
-----END PGP SIGNATURE-----
-----End of Document ID: HPSBUX0209-218--------------------------------------
Document ID: HPSBUX0208-212
Date Loaded: 20030414
Title: SSRT2328 Security Vulnerability in OpenSSL for JetDirect (rev.2)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
----------------------------------------------------------------
**REVISED 02**
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0208-212
Originally issued: 26 August 2002
Last Revised: 14 April 2003
SSRT2328 Security Vulnerability in OpenSSL for JetDirect (rev.2)
-----------------------------------------------------------------
NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.
The information in the following Security Bulletin should be
acted upon as soon as possible. Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.
-----------------------------------------------------------------
PROBLEM: Multiple potential vulnerabilities in OpenSSL
PLATFORM: HP Jetdirect Print Servers with Jetdirect Firmware
Versions X.22.00 through X.23.99
( where X = L through U ) only.
DAMAGE: Potential denial of service, unauthorized access.
**REVISED 02**
SOLUTION: Upgrade the firmware to X.24.06 or subsequent
(where X is a character from L to Z)
**REVISED 02**
MANUAL ACTIONS: Non-HP-UX only
Upgrade the firmware to X.24.06 or subsequent.
AVAILABILITY: The firmware is available now.
CHANGE SUMMARY: Rev.1 - modify MANUAL ACTIONS field
Rev.2 - firmware available
-----------------------------------------------------------------
A. Background
CERT (Computer Emergency Response Team) has recently posted
an alert regarding OpenSSL vulnerabilities in many network
devices that implement OpenSSL.
http://www.cert.org/advisories/CA-2002-23.html
Jetdirect Firmware Versions X.22.00 through X.23.99
( where X = L through U ) are vulnerable on these
products:
615n J6057A EIO 10/100 Print Server
610n J4169A EIO 10/100 Print Server
610n J4167A EIO 802.5 Print Server
680n J6058A EIO 802.11b Print Server
380x J6061A External 802.11b Print Server
310x J6038A External 10/100 Print Server
250m J6042A LIO 10/100 Print Server
B. Recommended solution
**REVISED 02**
-->Upgrade the firmware to X.24.06 or subsequent
--> (where X is a character from L to Z).
Please refer to the following for more information:
Upgrading Jetdirect Firmware
============================
1. Via the HP Download Manager
http://h20000.www2.hp.com/bizsupport/TechSupport/
Document.jsp?objectID=bpj06917
2. Via Web Jetadmin
http://h20000.www2.hp.com/bizsupport/TechSupport/
Document.jsp?objectID=bpj06529
Making Jetdirect Print Servers Secure on the Network
====================================================
http://h20000.www2.hp.com/bizsupport/TechSupport/
Document.jsp?objectID=bpj05999
Using the HP Jetdirect Embedded Web Server Security Wizard
==========================================================
http://h20000.www2.hp.com/bizsupport/TechSupport/
Document.jsp?objectID=bpj07576
C. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:
Use your browser to get to the HP IT Resource Center page
at:
http://itrc.hp.com
Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.
NOTE: Using your itrc account security bulletins can be
found here:
http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin
To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems. Please note that installing the patches
listed in the Security Patch Matrix will completely
implement a security bulletin _only_ if the MANUAL ACTIONS
field specifies "No."
The Security Patch Check tool can verify that a security
bulletin has been implemented on HP-UX 11.XX systems providing
that the fix is completely implemented in a patch with no
manual actions required. The Security Patch Check tool cannot
verify fixes implemented via a product upgrade.
For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA
The security patch matrix is also available via anonymous
ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".
The PGP key used to sign this bulletin is available from
several PGP Public Key servers. The key identification
information is:
2D2A7D59
HP Security Response Team (Security Bulletin signing only)
<security-alerthp.com>
Fingerprint =
6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59
If you have problems locating the key please write to
security-alerthp.com. Please note that this key is
for signing bulletins only and is not the key returned
by sending 'get key' to security-alerthp.com.
D. To report new security vulnerabilities, send email to
security-alerthp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alerthp.com.
-----------------------------------------------------------------
(c)Copyright 2003 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical or
editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of HP products referenced
herein are trademarks and/or service marks of Hewlett-Packard
Company. Other product and company names mentioned herein may be
trademarks and/or service marks of their respective owners.
________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Security 7.0.3
iQA/AwUBPpsXlOAfOvwtKn1ZEQIbcQCgmfB9OXSXDwwVqLcle7Fx+xkdRrYAnRlw
6+UcOHy35/fEQyLohi2Pn+Mj
=Vrss
-----END PGP SIGNATURE-----
-----End of Document ID: HPSBUX0208-212--------------------------------------
Document ID: HPSBUX0208-209
Date Loaded: 20030414
Title: SSRT2316 Sec. Vulnerability in DNS and resolver lib's (rev.10)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
-----------------------------------------------------------------
**REVISED 10**
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0208-209
Originally issued: 12 August 2002
Last revised: 14 April 2003
SSRT2316 Sec. Vulnerability in DNS and resolver lib's (rev.10)
-----------------------------------------------------------------
NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.
The information in the following Security Bulletin should be
acted upon as soon as possible. Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.
-----------------------------------------------------------------
PROBLEM: Potential buffer overflows in DNS resolver libraries.
PLATFORM: HP9000 Series 700/800 running HP-UX releases 11.00 and
11.11 (11i) with products using DNS resolver libraries,
including, but not limited to, Bind 9.x, Bind-8.1.2,
and libnss_dns.
HP9000 Series 700/800 running HP-UX release 10.20
HP9000 Series 700/800 running HP-UX release 10.10
HP9000 Series 700/800 running HP-UX release 10.24
or 11.04 (VVOS)
IMPACT: Potential unauthorized access, denial of service.
SOLUTION: Until a product upgrade is available, download and
install appropriate preliminary updates and the
appropriate preliminary or final patches.
MANUAL ACTIONS: Yes - NonUpdate
Install the applicable upgrades and patches
listed in the "Recommended solutions"
section (below).
**REVISED 10**
AVAILABILITY: The depots are available now.
BIND9.2.0 is available now. (11.11)
BIND-920 is available now. (11.00)
BIND812 is available now. (11.00)
The preliminary patches (depot files) are
available only from the ftp site (below) at
this time.
The following are available from the itrc:
PHCO_27882 for 10.24 (VVOS)
-->> PHNE_27795 for 11.00
-->> PHNE_28450 for 11.11.
This bulletin will be updated when a
product upgrade is available. This bulletin
will also be updated when solutions for
other vulnerable products are available.
CHANGE SUMMARY: Rev.01 - Added Bind-8.1.2. and libnss_dns
information.
Rev.02 - A patch was incorrectly listed,
PHNE_27647.depot is the correct number.
New version available,
BIND920ver3.depot.
Rev.03 - Added Bind-4.9.7 information for 11.00.
Rev.04 - Added Bind-4.9.7 information for 10.20.
Rev.05 - Added libc information for 10.20.
Rev.06 - Corrected "strings" to "strings -a"
Rev.07 - Added 11.04 and 10.24 information.
Rev.08 - BIND9.2.0 version 11.11.2.0.200209.
Updated to latest patches.
Added 10.10 information.
Rev.09 - BIND812 version B.11.00.01.004.
BIND-920 version B.11.00.01.001.
Added PHNE_27796 for 11.11.
Removed PHNE_27647.depot for 11.11.
Clarified 10.10 information.
Added CERT VU#738331 information.
Rev.10 - Added PHNE_27795 for 11.00.
Removed PHNE_27646.depot for 11.00.
Added PHNE_28450 for 11.11.
Removed PHNE_27794.depot for 11.11.
Added note that both client and server
systems are affected.
-----------------------------------------------------------------
A. Background
CERT advisory CA-2002-19 reports a buffer overflow
vulnerability which may affect products on HP-UX release
11.00 and release 11.11 (11i). The vulnerable products
include Bind 9.x. This bulletin will be
updated when solutions for other vulnerable products are
available.
CERT VU#738331 is fixed by the patches referenced below.
Bind-8.1.2 is vulnerable.
The libnss_dns.1 library is vulnerable.
Bind-4.9.7 is vulnerable.
HP-UX 10.20 programs calling the DNS API are vulnerable.
HP-UX 10.10 programs calling the DNS API are vulnerable.
**REVISED 10**
-> Note: These fixes should be applied to all systems using
-> DNS, including those systems with client programs only.
B. Recommended solution
The following preliminary fixes are available:
HP-UX 10.10
PHNE_27792.depot s700_800 10.10/10.20 Bind 4.9.7 components
AND
libc.1.1010, libc.a.1010 10.10 libc files
HP-UX 10.20
PHNE_27792.depot s700_800 10.10/10.20 Bind 4.9.7 components
AND
PHCO_26152.depot s700_800 10.20 libc
HP-UX 10.24
PHNE_27879.depot s700_800 10.24 (VVOS) BIND 4.9.7 components
AND
PHCO_27882: s700_800 10.24 (VVOS) libc
HP-UX 11.00
**REVISED 10**
BIND812 version B.11.00.01.004 or
subsequent from http://software.hp.com.
OR
BIND-920 version B.11.00.01.001 or
subsequent from http://software.hp.com.
OR
PHNE_27793.depot s700_800 11.00 Bind 4.9.7 components
AND
-->> PHNE_27795 s700_800 11.00 libnss_dns
HP-UX 11.04
PHNE_28415 s700_800 11.04 (VVOS) Bind 4.9.7 components
AND
PHNE_27881.depot s700_800 11.04 (VVOS) libnss_dns
HP-UX 11.11
BIND9.2.0 version 11.11.2.0.200209 or
subsequent from http://software.hp.com.
OR
-->> PHNE_28450 s700_800 11.11 Bind-8.1.2 patch
AND
PHNE_27796 s700_800 11.11 libnss_dns
Note: BIND9.2.0 version 11.11.2.0.200209 also corrects
potential problems reported in CERT advisory
CA-2002-23.
Note: The files mentioned below can be downloaded from
the following site. This site is temporary and
will be removed when the fixes become available
from the itrc.
System: hprc.external.hp.com (192.170.19.51)
Login: bind
Password: bind1
FTP Access: ftp://bind:bind1hprc.external.hp.com/
or: ftp://bind:bind1192.170.19.51/
file: upgrade_bind812_v4.depot.gz
Note: There is an ftp defect in IE5 that may result in
a browser hang. To work around this:
- Select Tools -> Internet Options -> Advanced
- Un-check the option: [ ] Enable folder view for FTP sites
Download and install the appropriate preliminary patch
from the ftp site listed above:
PHNE_27792.depot s700_800 10.10/10.20 Bind 4.9.7 components
PHCO_26152.depot s700_800 10.20 libc patch
PHNE_27879.depot s700_800 10.24 (VVOS) BIND 4.9.7 components
PHNE_27793.depot s700_800 11.00 Bind 4.9.7 components
PHNE_28415 s700_800 11.04 (VVOS) Bind 4.9.7 components
PHNE_27881.depot s700_800 11.04 (VVOS) libnss_dns
Note: If you wish to verify the md5 sum and you do not
have a copy of md5, please refer to:
HPSBUX9408-016
Patch sums and the MD5 program
Note: Using your itrc account security bulletins can be
found here:
http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin
MD5 (PHNE_27792.depot) = 613aa5827f0b4df4f51188857b5834d0
cksum 4143672841 696320 PHNE_27792.depot
MD5 (PHCO_26152.depot) = fbd411fb4ca5f392722415868ee8b6cb
cksum 2238979170 9676800 PHCO_26152.depot
MD5 (PHNE_27879.depot) = 90a570964b5cf48dadcd427f69bfdd16
cksum 2889539873 747520 PHNE_27879.depot
MD5 (PHNE_27793.depot) = 6f0f0f34c7a51688f6506c56da636689
cksum 4222745255 675840 PHNE_27793.depot
MD5 (PHNE_28415) = b07cd934bdcac2bf9cdfcbb2b44644de
cksum 1939013995 973906 PHNE_28415
MD5 (PHNE_27881.depot) = d53a774092f72e98cb62607b5882b576
cksum 1828722320 61440 PHNE_27881.depot
Note: On 10.10 and 10.20 the DNS API is contained in libc.
Programs which make DNS calls and are linked with
libc.a must be relinked.
Programs which are linked with ".a" libraries
are statically linked.
Statically linked programs may be tested as follows:
strings -a suspect_program | grep "Too many addresses (%d)"
If the program contains the string it may make
DNS API calls and should be relinked with the
fixed version of libc.a.
**REVISED 09**
Download libc.1.1010 and libc.a.1010 from the ftp
site mentioned above.
MD5 (libc.1.1010) = 87be3ba33250be16ad39345ed38f9875
cksum 1642516484 1716224 libc.1.1010
MD5 (libc.a.1010) = b680e1861a4b3ea4fc8fe55da63d62d2
cksum 4179986886 2280612 libc.a.1010
Install on 10.10 as follows:
1. Go to init state 2. Copy libc.1.1010 and
libc.a.1010 to a secure directory such as /.
2. cd /usr/lib
/usr/sbin/cp libc.1 libc.1.orig
/usr/sbin/cp /libc.1.1010 libc.1
/usr/sbin/cp libc.a libc.a.orig
/usr/sbin/cp /libc.a.1010 libc.a
3. Reboot the system.
- ------------------------------------------------------------------
C. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:
Use your browser to get to the HP IT Resource Center page
at:
http://itrc.hp.com
Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.
NOTE: Using your itrc account security bulletins can be
found here:
http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin
To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.
For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA
The security patch matrix is also available via anonymous
ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".
D. To report new security vulnerabilities, send email to
security-alerthp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alerthp.com.
----------------------------------------------------------------
(c)Copyright 2003 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical or
editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of HP products referenced
herein are trademarks and/or service marks of Hewlett-Packard
Company. Other product and company names mentioned herein may be
trademarks and/or service marks of their respective owners.
________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Security 7.0.3
iQA/AwUBPpsi7eAfOvwtKn1ZEQKXWwCdGflIt+XXPSIkQwSipmZuFtevtxoAnA2Y
R88VdmQSNWdPbdfPouMnS+FT
=9snz
-----END PGP SIGNATURE-----
-----End of Document ID: HPSBUX0208-209--------------------------------------
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]