-----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-Certificate: MIICozCCAgwCAREwDQYJKoZIhvcNAQECBQAwgYYxC zAJBgNVBAYTAlVTMSswKQYDVQQKEyJEZWZlbnNlIEluZm9ybWF0aW9uIFN5c3Rlb XMgQWdlbmN5MTAwLgYDVQQLEydDZW50ZXIgZm9yIEluZm9ybWF0aW9uIFN5c3Rlb XMgU2VjdXJpdHkxGDAWBgNVBAsTD0NvdW50ZXJtZWFzdXJlczAeFw05MzEyMDkxO DU5MTZaFw05NTEyMDkxODU5MTZaMIGxMQswCQYDVQQGEwJVUzErMCkGA1UEChMiR GVmZW5zZSBJbmZvcm1hdGlvbiBTeXN0ZW1zIEFnZW5jeTEwMC4GA1UECxMnQ2Vud GVyIGZvciBJbmZvcm1hdGlvbiBTeXN0ZW1zIFNlY3VyaXR5MRgwFgYDVQQLEw9Db 3VudGVybWVhc3VyZXMxEzARBgNVBAsTCk9wZXJhdGlvbnMxFDASBgNVBAMTC1Bld GUgSGFtbWVzMIGaMAoGBFUIAQECAgQAA4GLADCBhwKBgQDFFJkcaDOuS+6Ai2vmT bwY6JRbhdzPsl6X60hnXruOw2WvrAhc8BTFB+id75m3M55i+Th6MxWH20QHyQq5u yVghOu/s37OxIrj7irNPjtUdPv8b2m4hNGEW53QH6GmXkxLmgLzOhookpoYPC+uw 2MzibDnleVI50d2m//XsWs7hwIBAzANBgkqhkiG9w0BAQIFAAOBgQDHH6CmBoyWU zPlqVnEWYKIBsifqdTJzkKfnoST7NDRIakUP49FP86Cyy1+2AKpUCWaxjq+wGHCH RCNFCCrOwdC9z8XwJal/c69ml6eLRhOoX77ANndpU9E5+eHxP+6Ute6lc63K7+Lz 5xOULjmgaMmKDkTXveVcQO6R2CTY37vcA== Issuer-Certificate: MIICNTCCAZ4CASIwDQYJKoZIhvcNAQECBQAwRDELMAkGA 1UEBhMCVVMxCzAJBgNVBAgTAk1EMSgwJgYDVQQKEx9UcnVzdGVkIEluZm9ybWF0a W9uIFN5c3RlbXMgUENBMB4XDTk0MDIyNTE0NDkxMloXDTk0MDMwNzE0NDkxMlowg YYxCzAJBgNVBAYTAlVTMSswKQYDVQQKEyJEZWZlbnNlIEluZm9ybWF0aW9uIFN5c 3RlbXMgQWdlbmN5MTAwLgYDVQQLEydDZW50ZXIgZm9yIEluZm9ybWF0aW9uIFN5c 3RlbXMgU2VjdXJpdHkxGDAWBgNVBAsTD0NvdW50ZXJtZWFzdXJlczCBmjAKBgRVC AEBAgIEAAOBiwAwgYcCgYEA19l6BN7iTGYEU61qJETIjBh3iAeHzoL8sZ5KwFRZD S/a1KnYlD1zJHR/KeQCOBWW2HzX43TFLCNGU7UD9i6m8AymLe5IJf/bGh0Rne7Jd Q1GAOLw7/J4hE57IMbGETZpzeU1D9IYxiERRNio/oa422lUlS9JZHLA5jaPNcUrX P8CAQMwDQYJKoZIhvcNAQECBQADgYEApkliqAdudoOxvOFmQkOZbSgtlpn61VcNC R7azDNJa2ulevaebptwSTs2OvMeuR/J0Ez4TC7XrJXLVjI5huRAqc+EWGRpZYRMa CARZyE7gGYjUqS7DIQazfskeWiB8zheyW5tCVn+jnB09AZXtgbM6qRjyqrmSdCpg CtfgazIKqI= Issuer-Certificate: MIIB8jCCAVsCAQEwDQYJKoZIhvcNAQECBQAwRDELMAkGA 1UEBhMCVVMxCzAJBgNVBAgTAk1EMSgwJgYDVQQKEx9UcnVzdGVkIEluZm9ybWF0a W9uIFN5c3RlbXMgUENBMB4XDTkzMDUyODE3MTEyN1oXDTk1MDUyODE3MTEyN1owR DELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1EMSgwJgYDVQQKEx9UcnVzdGVkIEluZ m9ybWF0aW9uIFN5c3RlbXMgUENBMIGaMAoGBFUIAQECAgQAA4GLADCBhwKBgQDbL xaRlS3u54yyRgVDI5dcE9nlasL8fJqOGlyo7xH2FZnr3kUfsFj7OGiYsr6UbvqwK nyfMIRUrXDUa64leGmft3SK27psDUHOynRSCc40d/HrDf810U5tnTamBKUIMqivK 4GoL0tMRA1eX6hALAvLLgK1HbnwZAo6GqQGW8CIJQIBAzANBgkqhkiG9w0BAQIFA AOBgQDBp5aC6oV6IuFi8JCctq57bew604HHNllgjjp7zdXafq6jctRg2g91k/yFW h19bJC/tNrb0WVwuZOs5L/FToPMNIIHzaW/YSROBmyhTDYaKHZGj0P1+iNjMbHt9 dm1QEHGIfKgBwFidItnOa74DfkXdijlPRnr/+E2Ib6PM+hEfQ== MIC-Info: RSA-MD5,RSA,H8xy2FLDrXOQxxz8h8MUZsN+uWJpgP+l2yHjKDH8RVT Tp9GibbwhkVno+C3vrDt8f8LVp6MVOI2p8Ho0AnSQ0six81u2s1DM+hMSOjm3oZu wEH/YRaMqyMezwaiDOTTi1/e/Zi3eP30FuDTqTMxTjtAp2B4J+H2W7UiN11RcjQI = <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Automated Systems Security Incident Support Team _____ ___ ___ _____ ___ _____ | / /\ / \ / \ | / \ | | / Integritas / \ \___ \___ | \___ | | < et /____\ \ \ | \ | | \ Celeritas / \ \___/ \___/ __|__ \___/ | |_____\ <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Bulletin 95-08 Release date: 28 February, 1995, 1:00 PM EST (GMT -5) SUBJECT: HP-UX Malicious Code Sequences. SUMMARY: Malicious coding sequences can cause security vulnerabilities in HP-UX 9.x. BACKGROUND: Malicious coding sequences which can be used to compromise the security and/or integrity of an HP-UX 9.x system. IMPACT: This vulnerability can cause the HP-UX Operating System to crash or allow unauthorized access. RECOMMENDED SOLUTION: Obtain and install the appropriate patch as described in the HP security bulletin listed below. NOTE: Hewlett Packard updates patches periodically. These updates are not reflected in the text of each HP bulletin. The overview presented here contains current information on the patches available at the time of the release of this bulletin. If you request an updated patch, when you try to retrieve the patch you will receive a message stating that the patch is obsolete and the name of the patch which supersedes it. Following is the copy of the HP bulletin (HPSBUX9502-022): [Begin HP Bulletin] - ---------------------------------------------------------------------- HEWLETT-PACKARD SECURITY BULLETIN: #00022, 15 February 95 - ---------------------------------------------------------------------- The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. - ---------------------------------------------------------------------- PROBLEM: Security vulnerability involving malicious users PLATFORM: HP 9000 series 700 and series 800 at revisions 9.X DAMAGE: Users can gain unauthorized privileges SOLUTION: Apply the appropriate patch for your version of HP-UX For HP-UX 9.09+ (BLS), apply patch PHKL_5190, HP-UX 9.09 (BLS), apply patch PHKL_5191, HP-UX 9.08 (BLS), apply patch PHKL_5192, HP-UX 9.05, apply patch PHKL_5049, HP-UX 9.04, apply patch PHKL_5051, HP-UX 9.03, apply patch PHKL_5049, HP-UX 9.01, apply patch PHKL_5048, HP-UX 9.0 , apply patch PHKL_5050. AVAILABILITY: All patches are available now. - ---------------------------------------------------------------------- A. Problem Hewlett-Packard has discovered some malicious coding sequences that can cause the HP-UX Operating System to crash. These coding sequences are malicious in origin and not representative of compiler generated code. The resulting system crash is not always predictable, depending heavily on the state of the system at the time of the attack. Given this uncertainty, it is feasible that the security and/or integrity of the system might become compromised. Having identified this type of system vulnerability, HP has developed a patch that when installed provides the following countermeasures. First, it will protect your system from privilege violations that might be attempted using these malicious coding sequences. Secondly, it strengthens the Operating System so that it is more resistant to this type of attack. Should the attack succeed in crashing the system, this patch will in most cases report the identity of the process and user that executed the malicious coding sequences. System Administrators can use this identification information to help track down the source of such attacks on their system. B. What the Patch Does This patch replaces key HP-UX library routines C. How to Get The Patch For HP-UX BLS product patches PHKL_5190, PHKL_5191 & PHKL_5192 are NOT electronically available. For assistance in obtaining and installing this patch contact the HP Response Center at 1 (800) 633-3600. Be sure to mention the keyword "BLS" to help route the call. All the other patches are available electronically. You can retrieve a patch by using the service described below. D. How to Install The Patch 1. Determine which patch is appropriate for your hardware platform and operating system: On the BLS product, HP-UX 9.08 (series 800) & HP-UX 9.09 (series 700), execute: what /hp-ux . On commercial products HP-UX 9.X (series 800) & HP-UX 9.X (series 700), execute: what /hp-ux . Look for the product 9245XA (series 800) and B2352A (series 700) to identify the revision currently running. Then use the table above to select the appropriate patch to request or retrieve. 2. Hewlett Packard's HP-UX patches are available via email & WWW (MOSAIC) To obtain a copy of the HP SupportLine email service user's guide, send the following in the TEXT PORTION OF THE MESSAGE to support@support.mayfield.hp.com (no Subject is required): send guide The users guide explains the process for downloading HP-UX patches via email and other services available. WWW (MOSAIC) service (downloading of patches) is also available via WWW (MOSAIC) our URL is: (http://support.mayfield.hp.com) 3. Apply the patch to your HP-UX system. 4. Examine /tmp/update.log for any relevant WARNINGs or ERRORs. This can be done as follows: a. At the shell prompt, type "tail -60 /tmp/update.log | more" b. Page through the next three screens via the space bar, looking for WARNING or ERROR messages. E. Impact of the patch and workaround No patches will be available for versions of HP-UX prior to 9.0. F. How to get Help If you need help installing a patch and have a Support Contract you can call the HP Response Center at 1 (800) 633-3600. If you have no Support Contract, call the same number and ask to make a "Helpline" call for assistance (payable via credit card). Since security patches are treated very carefully by HP yet are available free of charge, no additional information about the security issues addressed by these patches will be given. G. To subscribe to automatically receive future NEW HP Security Bulletins from the HP Support-Line mail service via electronic mail, send an e-mail message to: support@support.mayfield.hp.com (no Subject is required) Multiple instructions are allowed in the TEXT PORTION OF THE MESSAGE, here are some basic instructions you may want to use: * To add your name to the subscription list for new Security Bulletins, send the following in the TEXT PORTION OF THE MESSAGE: subscribe security_info * To retrieve the index of all HP Security Bulletins issued to date, send the following in the TEXT PORTION OF THE MESSAGE: send security_info_list WWW (MOSAIC) service (Browsing of Bulletins) is also available via WWW (MOSAIC) our URL is: http://support.mayfield.hp.com Choose "Support news", then under Support news, choose "Security Choose "Support news", then under Support news, choose "Security Bulletins" H. To report new security vulnerabilities, send email to security-alert@hp.com - ---------------------------------------------------------------------- [End HP Bulletin] ASSIST would like to thank the Hewlett Packard Corporation for information contained in this bulletin. <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ASSIST is an element of the Defense Information Systems Agency (DISA), Center for Information Systems Security (CISS), that provides service to the entire DoD community. Constituents of the DoD with questions about ASSIST or computer security security issues, can contact ASSIST using one of the methods listed below. Non-DoD organizations/institutions, contact the Forum of Incident Response and Security Teams (FIRST) (FIRST) representative. To obtain a list of FIRST member organizations and their constituencies send an email to docserver@first.org with an empty "subject" line and a message body containing the line "send first-contacts". ASSIST Information Resources: To be included in the distribution list for the ASSIST bulletins, send your Milnet (Internet) e-mail address to assist-request@assist.mil. Back issues of ASSIST bulletins, and other security related information, are available from the ASSIST BBS at 703-756-7993/1154 DSN 289-7993/1154, and through anonymous FTP from assist.mil (IP address 199.211.123.11). Note: assist.mil will only accept anonymous FTP connections from Milnet addresses that are registered with the NIC or DNS. ASSIST Contact Information: PHONE: 800-357-4231 (or 703-756-7974 DSN 289), duty hours are 06:00 to 22:30 EDT (GMT -4) Monday through Friday. During off duty hours, weekends and holidays, ASSIST can be reached via pager at 800-791- 4857. The page will be answered within 30 minutes, however if a quicker response is required, prefix the phone number with "999". ELECTRONIC MAIL: Send to assist@assist.mil. ASSIST BBS: Leave a message for the "sysop". Privacy Enhanced Mail (PEM): ASSIST uses PEM, a public key encryption tool, to digitally sign all bulletins that are distributed through e-mail. The section of seemingly random characters between the "BEGIN PRIVACY-ENHANCED MESSAGE" and "BEGIN ASSIST BULLETIN" contains machine-readable digital signature information generated by PEM, not corrupted data. PEM software for UNIX systems is available from Trusted Information Systems (TIS) at no cost, and can be obtained via anonymous FTP from ftp.tis.com (IP 192.94.214.96). Note: The TIS software is just one of several implementations of PEM currently available and additional versions are likely to be offered from other sources in the near future. Reference herein to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by ASSIST. The views and opinions of authors expressed herein shall not be used for advertising or product endorsement purposes. -----END PRIVACY-ENHANCED MESSAGE-----