OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Solaris Security Patches - notification formats/methods - latest matrix
From: Craig, Scott (SCraigKMART.COM)
Date: Wed May 24 2000 - 09:51:19 CDT

I'd like to make a RFLW (Request For Less Work) to Sun regarding
notification of security patch availability.
I think this was discussed in a Bugtraq discussion group not too long ago,
and I've sent requests through a local Sun rep in the past - who forwarded
my request on, but I still haven't seen or heard from Sun regarding a better
way of notifying everyone of Solaris Security patches.

This morning, the 05/24/00 PatchClub Report from the SunSolve-EarlyNotifier
service appeared in my inbox. This comes out every 2 weeks but is a somewhat
lengthy message listing out all recently published Solaris patches. The
table at the top shows patch number and short description. In the meat of
the report, each patch has a keyword line, in which you may see "security".
I try to scan these reports and then extract the patches mentioning security
to make them a more pressing patch to be applied. System administrators
don't always want to apply the recommended and security patch clusters on a
regular basis.

The Sun CWS mailing list rarely sees traffic. I actually like the format
that HP publishes their security bulletins digest in. It's also been pretty
reliable for the past few years.

Here's what I compiled out of today's patchclub report:

Sun SPARC Solaris Security Patch Matrix
Published 05/19/00

 ---------------------------------------------------------------
| Description | 2.5.1 | 2.6 | 7 |
|===============================================================|
| Solstice Adminsuite 2.3 | | | |
| / AutoClient 2.1 | | | |
| y2000 NIS+ BSM | 104468-19 | 104468-19 | 104468-19 |
|---------------------------------------------------------------|
| lp patch | | 106235-05 | |
|---------------------------------------------------------------|
| /usr/bin/ftp | | 106522-04 | 107454-05 |
|---------------------------------------------------------------|
| Kernel Update | | | 106541-11 |
|---------------------------------------------------------------|
| CDE 1.3: Actions | | | 107887-09 |
|---------------------------------------------------------------|

Sun x86 Solaris Security Patch Matrix
Published 05/19/00

 ---------------------------------------------------------------
| Description | 2.5.1 | 2.6 | 7 |
|===============================================================|
| /usr/bin/ftp | | 106523-04 | 107455-05 |
|---------------------------------------------------------------|
| Kernel Update | | | 106542-11 |
|---------------------------------------------------------------|

106235-05 has been mentioned in this discussion group before, as relates to
Bugtraq ID 1200.
I believe that even though these patches may list security in their keyword
listing, it may be inserted into the keywords from a previous patch from a
previously fixed BugID.

If someone has suggestions for formats and content for the notifications of
Sun Security Patches, let's get the discussion rolling and show Sun our
enthusiasm in this area!

Scott