OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Boren, Rich (SSRT) (Rich.Boren_at_hp.com)
Date: Tue Oct 08 2002 - 20:43:17 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

     
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    SECURITY BULLETIN

    REVISION: 0

    TITLE: SSRT2208 - HP Tru64 UNIX /usr/sbin/routed Potential
                      Security Vulnerability

    NOTICE: There are no restrictions for distribution of this
            Bulletin provided that it remains complete and intact.

    RELEASE DATE: 07 October 2002

    SEVERITY: High

    SOURCE: Compaq Computer Corporation,
             a wholly-owned subsidiary of
             Hewlett-Packard Company and
             Hewlett-Packard Company
             HP Services
             Software Security Response Team

    REFERENCE: SSRT2208

    PROBLEM SUMMARY

    This bulletin will be posted to the support website
    within 24 hours of release to -
    http://thenew.hp.com/country/us/eng/support.html
    Use the SEARCH IN feature box, enter SSRT2208 in the search window.

    SSRT2208 /usr/sbin/routed (Severity High)

    A potential security vulnerability in routed has been reported
    in the HP Tru64 UNIX operating system that may result in unauthorized
    access to files on the system. This may be in the form of local and
    remote security domain risks.

    VERSIONS IMPACTED

            HP Tru64 UNIX V5.1A

            HP Tru64 UNIX V5.1

            HP Tru64 UNIX V5.0A

            HP Tru64 UNIX V4.0G

            HP Tru64 UNIX V4.0F

    NOT IMPACTED

            HP-UX

            HP-MPE/ix

            HP NonStop Servers

            HP OpenVMS
     
    RESOLUTION

    Early Release Patches (ERPs) are now available for all supported
    versions of HP Tru64 UNIX/TruCluster Server that provide a solution
    to this potential vulnerability. The ERP kits use dupatch to install
    and will not install over any Customer Specific Patches (CSPs) which
    have file intersections with the ERPs. Contact your normal support
    channel and request HP Tru64 services elevate a case to Support
    Engineering if a CSP must be merged with one of the ERPs. Please
    review the README file for each patch prior to installation.

    HP Tru64 UNIX 5.1A
    PREREQUISITE: Tru64 UNIX/TruCluster Server with PK3 (BL03) installed
    ERP Kit Name: t64v51ab3-c0045704-15383-es-20020906.tar
    Kit Location: http://ftp1.support.compaq.com/public/unix/v5.1a/

    HP Tru64 UNIX/TruCluster Server V5.1A with PK2 (BL2) installed:
    update to a minimum of PK3(BL3) then install
    ERP t64v51ab3-c0045704-15383-es-20020906.tar

    HP Tru64 UNIX V5.1
    PREREQUISITE: Tru64 UNIX/TruCluster Server with PK5 (BL19) installed
    ERP Kit Name: t64v51b19-c0140503-15377-es-20020906.tar
    Kit Location: http://ftp1.support.compaq.com/public/unix/v5.1/

    HP Tru64 UNIX/TruCluster Server V5.1 with PK4 (BL18) installed:
    Update to a minimum of PK5 (BL19) then install
    ERP t64v51b19-c0140503-15377-es-20020906.tar

    HP Tru64 UNIX 5.0A
    PREREQUISITE: Tru64 UNIX/TruCluster Server with PK3 (BL17) installed
    ERP Kit Name: t64v50ab17-c0023202-15364-es-20020905.tar
    Kit Location: http://ftp1.support.compaq.com/public/unix/v5.0a/

     

    HP Tru64 UNIX 4.0G
    PREREQUISITE: Tru64 UNIX/TruCluster Server with PK3 (BL17) installed
    ERP Kit Name: t64v40gb17-c0019502-15361-es-20020905.tar
    Kit Location: http://ftp1.support.compaq.com/public/unix/v4.0g/

     

    HP Tru64 UNIX 4.0F
    PREREQUISITE: Tru64 UNIX/TruCluster Server with PK7 (BL18) installed
    ERP Kit Name: duv40fb18-c0081602-15358-es-20020905.tar
    Kit Location: http://ftp1.support.compaq.com/public/unix/v4.0f/

    Information on how to verify MD5 and SHA1 checksums is
    available at: http://www.support.compaq.com/patches/whats-new.shtml

    After completing the update, HP and Compaq strongly recommend that you
    perform an immediate backup of the system disk so that any subsequent
    restore operations begin with updated software. Otherwise, the updated
    must be re-applied after a future restore operation. Also, if at some
    future time the system is upgraded to a later patch release or version
    release, reinstall the appropriate ERP.

    SUPPORT: For further information, contact HP Services.

    SUBSCRIBE: To subscribe to automatically receive future Security
    Advisories from the Software Security Response Team via electronic mail:
    http://www.support.compaq.com/patches/mailing-list.shtml
     
    REPORT: To report a potential security vulnerability with any HP or
    Compaq supported product, send email to: security-alerthp.com

    HP and Compaq appreciate your cooperation and patience. As always,
    HP and Compaq urge you to periodically review your system management
    and security procedures. HP and Compaq will continue to review and
    enhance the security features of its products and work with our customers
    to maintain and improve the security and integrity of their systems.

    "HP and Compaq are broadly distributing this Security Bulletin in order
    to bring to the attention of users of the affected Compaq products the
    important security information contained in this Bulletin. HP and Compaq
    recommend that all users determine the applicability of this information
    to their individual situations and take appropriate action. Neither HP
    nor Compaq warrant that this information is necessarily accurate or
    complete for all user situations and, consequently, neither HP nor Compaq
    will be responsible for any damages resulting from user's use or disregard
    of the information provided in this Bulletin."

    ęCopyright 2002 Hewlett-Packard Company
    Hewlett-Packard Company shall not be liable for technical or editorial
    errors or omissions contained herein. The information in this document
    is subject to change without notice. Hewlett-Packard Company and the names
    of Hewlett-Packard products referenced herein are trademarks of
    Hewlett-Packard Company in the United States and other countries.
    Other product and company names mentioned herein may be trademarks
    of their respective owners.

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 7.0.4

    iQA/AwUBPaOJrznTu2ckvbFuEQJxZACgzoJIV/qa3OpexoppwXSStmqbUfcAoLOG
    ToIbf1usPDp7e8TmhiRNJMDa
    =0qId
    -----END PGP SIGNATURE-----

    ---