-----BEGIN PGP SIGNED MESSAGE----- <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Automated Systems Security Incident Support Team _____ ___ ___ _____ ___ _____ | / /\ / \ / \ | / \ | | / Integritas / \ \___ \___ | \___ | | < et /____\ \ \ | \ | | \ Celeritas / \ \___/ \___/ __|__ \___/ | |_____\ <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Bulletin 95-13 Release date: 21 April, 1995, 4:15 AM/PM EDT (GMT -4) SUBJECT: Three security vulnerabilities in the MPE/iX operating system. SUMMARY: The vulnerabilities detailed in this bulletin affect HP3000 (Hewlett Packard) Series 900 systems running any release of MPE through and including the Limited Release of MPE/iX 5.0 (X.50.20). BACKGROUND: The RECOMMENDED SOLUTION section below contains HP bulletin information for each of the three MPE/iX security vulnerabilities. Also included is information about how to obtain patches from HP and report security problems to the company. IMPACT: The security vulnerabilities in the MPE/iX operating system can be used by local users to gain unauthorized access privileges which may result in system compromise. RECOMMENDED SOLUTION: =============================================================== Description: Security Vulnerability (HPSBMP9503-003) in MPE/iX releases. The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. PROBLEM: Security vulnerability in the MPE/iX operating system PLATFORM: HP3000 Series 900 systems running any release of MPE through and including the Limited Release of MPE/iX 5.0 (X.50.20) DAMAGE: Users can gain additional privileges and/or special capabilities. SOLUTION: Update all systems to the General Release of MPE/iX 5.0, or Apply patch MPEHX26A (MPE/iX Release 4.0 B.40.00), or patch MPEHX26B (Limited Release MPE/iX 5.0 X.50.20) FIX: The problem is fixed in the General Release of MPE/iX 5.0 (C.50.00). AVAILABILITY: The 5.0 General Release and all patches are available now. Problem Description - ------------------- It has been found that HP 3000 systems running MPE/iX Release 4.0 (B.40.00), Release 4.5 (C.45.00), and the Limited Release of MPE/iX 5.0 (X.50.20) have a vulnerability that can be exploited by users to gain additional privileges and/or capabilities, but only if the users are already logged on to the system. This problem does not permit a user to gain additional privileges by accident. However, a user can exploit this vulnerability to gain System Manager (SM) capability. Fixing the problem - ------------------ Hewlett-Packard recommends that you update your HP 3000 Series 900 computer systems to the General Release of MPE/iX 5.0 (C.50.00), as this problem is fixed in that release. Updating to the 5.0 General Release is the easiest and safest way to get the fix for this security problem. Customers with HP System Support contracts should have already received their shipments of the General Release of MPE/iX 5.0 (C.50.00). However, if you feel that you cannot update to the 5.0 General Release at this time, the proper corrective measure depends on which release of MPE/iX your HP 3000 system is running. The vulnerability can be eliminated from Release 4.0 and the Limited Release of MPE/iX 5.0 by applying a patch, MPEHX26A or MPEHX26B. Release 4.5 (C.45.00) MUST be updated to the General Release of MPE/iX 5.0 (C.50.00), as no patch will be created for Release 4.5. No patches will be available for versions of MPE/iX prior to Release 4.0. Instead, you must update to a supported release. HP recommends that you update such systems to the General Release of MPE/iX 5.0. If you update to one of the other supported releases, you will have to follow the patch instructions described in the next section of this bulletin. How to Install the Patch (for MPE/iX 4.0 & Limited Release MPE/iX 5.0) - ---------------------------------------------------------------------- 1. Determine which patch is appropriate for your operating system release: MPEHX26A for Series 900, MPE/iX 4.0 (B.40.00) MPEHX26B for Series 900, Limited Release MPE/iX 5.0 (X.50.20) Impact of the patch and workaround - ---------------------------------- Application of the patch will eliminate the vulnerability. ======================================================================= Description: Security Vulnerability (HPSBMP9503-002) in MPE/iX releases The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. PROBLEM: Security vulnerability in the MPE/iX operating system PLATFORM: HP3000 Series 900 systems running the Limited Release of MPE/iX 5.0 DAMAGE: Users can gain access to a higher TurboImage privilege SOLUTION: Update all systems to the General Release of MPE/iX 5.0, or Apply patch MPEHX25A (Limited Release MPE/iX 5.0 X.50.20). FIX: The problem is fixed in the General Release of MPE/iX 5.0 (C.50.00) AVAILABILITY: The 5.0 General Release and all patches are available now. Problem Description - ------------------- It has been found that HP 3000 systems running the Limited Release of MPE/iX 5.0 (X.50.20) have a vulnerability that can be exploited by logged on users to gain a higher TurboImage privilege. This problem does not permit a user to gain additional privileges by accident. Fixing the problem - ------------------ Hewlett-Packard recommends that you update your HP 3000 Series 900 computer systems to the General Release of MPE/iX 5.0 (C.50.00), as this problem is fixed in that release. Updating to the 5.0 General Release is the easiest and safest way to get the fix for this security problem. Customers with HP System Support contracts should have already received their shipments of the General Release of MPE/iX 5.0 (C.50.00). However, if you feel that you cannot update to the 5.0 General Release at this time, the vulnerability can be eliminated from the Limited Release of MPE/iX 5.0 by applying a patch, MPEHX25A. How to Install the Patch (for the Limited Release MPE/iX 5.0) - ------------------------------------------------------------- 1. Determine which patch is appropriate for your operating system release: MPEHX25A for Series 900, Limited Release MPE/iX 5.0 (X.50.20) Impact of the patch and workaround - ---------------------------------- Application of the patch will eliminate the vulnerability. ======================================================================= Description: Security Vulnerability (HPSBMP9503-001) in MPE/iX releases The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. PROBLEM: Security vulnerability in the MPE/iX operating system PLATFORM: HP3000 Series 900 systems running Release 4.0, Release 4.5, and the 5.0 Limited Release of MPE/iX DAMAGE: Users can gain additional privileges and/or special capabilities SOLUTION: Update all systems to the General Release of MPE/iX 5.0, or Apply patch MPEHX24A (MPE/iX Release 4.0 B.40.00), or patch MPEHX24B (Limited Release MPE/iX 5.0 X.50.20) FIX: The problem is fixed in the General Release of MPE/iX 5.0 (C.50.00) AVAILABILITY: The 5.0 General Release and all patches are available now. Nature of the problem - --------------------- It has been found that HP 3000 systems running MPE/iX Release 4.0 (B.40.00), Release 4.5 (C.45.00), and the Limited Release of MPE/iX 5.0 (X.50.20) have a vulnerability that can be exploited by users to gain additional privileges and/or capabilities, but only if the users are already logged on to the system. This problem does not permit a user to gain additional privileges by accident. However, a user can exploit this vulnerability to gain System Manager (SM) capability. Fixing the problem - ------------------ Hewlett-Packard recommends that you update your HP 3000 Series 900 computer systems to the General Release of MPE/iX 5.0 (C.50.00), as this problem is fixed in that release. Updating to the 5.0 General Release is the easiest and safest way to get the fix for this security problem. Customers with HP System Support contracts should have already received their shipments of the General Release of MPE/iX 5.0 (C.50.00). However, if you feel that you cannot update to the 5.0 General Release at this time, the proper corrective measure depends on which release of MPE/iX your HP 3000 system is running. The vulnerability can be eliminated from Release 4.0 and the Limited Release of MPE/iX 5.0 by applying a patch, MPEHX24A/B. Release 4.5 (C.45.00) MUST be updated to the General Release of MPE/iX 5.0 (C.50.00), as no patch will be created for Release 4.5. How to Install the Patch (for MPE/iX 4.0 & Limited Release MPE/iX 5.0) - ---------------------------------------------------------------------- Determine which patch is appropriate for your operating system release: MPEHX24A for Series 900, MPE/iX 4.0 (B.40.00) MPEHX24B for Series 900, Limited Release MPE/iX 5.0 (X.50.20) Apply the patch to your MPE/iX system. Installation instructions are included with the MPE/iX SECURITY PATCH product. NOTE: IF YOU DECIDE TO APPLY ONE OF THE TWO PATCHES MENTIONED ABOVE RATHER THAN UPDATE YOUR HP 3000 TO THE GENERAL RELEASE OF MPE/iX 5.0, YOU MUST RE-APPLY ALL MPE/iX PATCHES PREVIOUSLY INSTALLED ON YOUR SYSTEM. Patch MPEHX24A/B replaces the Operating System SOM (OS SOM) in NL.PUB.SYS. This process has the effect of removing all previously installed MPE/iX patches from the OS SOM. You can obtain all prior General Release patches by ordering the current MPE/iX PowerPatch tape (B.40.09) for Release 4.0 or the current MPE/iX PowerPatch tape (X.50.24) for the Limited Release of 5.0. If you have an HP System Support contract, call your local Hewlett-Packard support contact. Otherwise, call your local HP Sales representative and order Product Number 50757A -- PowerPatch Tape. Be sure to indicate which version of the PowerPatch tape you require and the correct media type. PowerPatch tapes are available free of charge to customers who have an HP System Support contract and at a nominal charge to customers who do not. Impact of the patch and workaround - ---------------------------------- Application of the patch will eliminate the vulnerability (see (3) above). ===================================================================== How to Obtain HP Patches - ------------------------ If you have an HP System Support contract, you should be receiving a security notification packet that includes a FAX-back form for ordering the patches that fix the problems described in the following three Security Bulletins -- HPSBMP9503-001, HPSBMP9503-002, and HPSBMP9503-003. If you do not have an HP System Support contract, you can obtain the same patches by ordering MPE/iX SECURITY PATCH, Product Number B5116AA. This product is available at no charge. When ordering the product, you need to know which MPE/iX release you are patching and on what media you want the patch delivered. The following chart shows the two product options: Option Table for Product Number B5116AA 1600BPI 6250BPI Tape Tape DDS |---------|---------|---------| B.40.00 | 240,AA1 | 240,AA2 | 240,AAH | |---------|---------|---------| X.50.20 | 250,AA1 | 250,AA2 | 250,AAH | |---------|---------|---------| Phone numbers to HP Direct and other HP Country Sales offices have been included at the end of this bulletin for your convenience. 3. Applying the patch to your MPE/iX system. Installation instructions are included with the MPE/iX SECURITY PATCH product. Obtaining General Security Information To subscribe to automatically receive future NEW HP Security Bulletins from the HP SupportLine mail service via electronic mail, send an email message to: support@support.mayfield.hp.com (no Subject is required) Multiple instructions are allowed in the TEXT PORTION OF THE MESSAGE, here are some basic instructions you may want to use: To add your name to the subscription list for new Security Bulletins, send the following in the TEXT PORTION OF THE MESSAGE: subscribe security_info To retrieve the index of all HP Security Bulletins issued to date, send the following in the TEXT PORTION OF THE MESSAGE: send security_info_list World Wide Web service for browsing of bulletins is available via the HPSL URL: http://support.mayfield.hp.com Choose "Support news", then under Support news, choose "Security Bulletins" To report new security vulnerabilities, send email to: security-alert@hp.com <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ASSIST is an element of the Defense Information Systems Agency (DISA), Center for Information Systems Security (CISS), that provides service to the entire DoD community. Constituents of the DoD with questions about ASSIST or computer security security issues, can contact ASSIST using one of the methods listed below. Non-DoD organizations/institutions, contact the Forum of Incident Response and Security Teams (FIRST) (FIRST) representative. To obtain a list of FIRST member organizations and their constituencies send an email to docserver@first.org with an empty "subject" line and a message body containing the line "send first-contacts". ASSIST Information Resources: To be included in the distribution list for the ASSIST bulletins, send your Milnet (Internet) e-mail address to assist-request@assist.mil. Back issues of ASSIST bulletins, and other security related information, are available from the ASSIST BBS at 703-756-7993/1154 DSN 289-7993/1154, and through anonymous FTP from assist.mil (IP address 199.211.123.11). Note: assist.mil will only accept anonymous FTP connections from Milnet addresses that are registered with the NIC or DNS. ASSIST Contact Information: PHONE: 800-357-4231 (or 703-756-7974 DSN 289), duty hours are 06:00 to 22:30 EDT (GMT -4) Monday through Friday. During off duty hours, weekends and holidays, ASSIST can be reached via pager at 800-791- 4857. The page will be answered within 30 minutes, however if a quicker response is required, prefix the phone number with "999". ELECTRONIC MAIL: Send to assist@assist.mil. ASSIST BBS: Leave a message for the "sysop". ASSIST uses Pretty Good Privacy (PGP) 2.6.2 as the digital signature mechanism for bulletins. PGP 2.6.2 incorporates the RSAREF(tm) Cryptographic Toolkit under license from RSA Data Security, Inc. A copy of that license is available via anonymous FTP from net-dist.mit.edu (IP 18.72.0.3) in the file /pub/PGP/rsalicen.txt. In accordance with the terms of that license, PGP 2.6.2 may be used for non-commercial purposes only. Instructions for downloading the PGP 2.6.2 software can also be obtained from net-dist.mit.edu in the pub/PGP/README file. PGP 2.6.2 and RSAREF may be subject to the export control laws of the United States of America as implemented by the United States Department of State Office of Defense Trade Controls. The PGP signature information will be attached to the end of ASSIST bulletins. Reference herein to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by ASSIST. The views and opinions of authors expressed herein shall not be used for advertising or product endorsement purposes. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi4uZ40AAAEEAM1uraimCNeh5PtzX7KoGxC2u8uMTdl8V5sujk3MHbWvCuOM W0FqDy5s9iwfQLZWzJ7cbM6L0mNOj8eJGoz7TqGKZDDRFlKAwg0x8joleZLC2gXw FVdF/g6Mdv7ok7heoa+Y//YMeADnsSrmzqLCnhFbKYffww3EbdH6sbnW3Io9AAUR tB9BU1NJU1QgVGVhbSA8YXNzaXN0QGFzc2lzdC5taWw+iQCVAwUQL1xx7tH6sbnW 3Io9AQEBYwP9FvIJbnKjtMLUj8ghd6hophSx8WZnfQsOmZX/BbX8vKz1a5BkBn4q ANvW+uKGdUlE8LLMEm1PD59Cihcb3OoWDOU8zIOIErvry4eqa+LzEXV8nnBdes+A a1MCMGSz+K3OaP78lQ7JCGoY9TXTWIelfAdBVBG4VQcSQRn8tjRdG2e0KEFTU0lT VCBUZWFtIDxhc3Npc3RAYXNzaXN0Lmltcy5kaXNhLm1pbD6JAJUCBRAuLnHoh0Y9 0jC+b6kBAU0TA/4yXSL7K6tcfVm9ACnP4crCoutFM2w10e7YKxD850ajhWrh6rI9 O+sjU5WObqiPJ7sZHdEw/KARzPSijH/5h8HlyYa6ClksWxYuymzCsUYYJctdjcGr uakfXgYQ1TkkyUfNrN5G90NuRK/vTRe7bkmyGNYjN9Njac1Q18WVF59Chg== =d5rP - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBL5gT+NH6sbnW3Io9AQHrBwQAggvPUCKe8ZFAkvXkkoQCvKreXYqfDvUZ 35wKAedQO+zjU/jcX5Zdi9QgbcC/Xjxf5+9h+tXPw33ZDX+klVtAfAiBMpUtxBsH vzLwqxEUM/uBz1MtvZKpd195aTtahWmPGyDdHzqCmnGcR+/Ahw3Z/0J6Dbeu9YJk /M5DdJW13pY= =vlI1 -----END PGP SIGNATURE-----