-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                 ESB-2002.641 -- COMPAQ SECURITY BULLETIN
    SSRT2385 OSIS V5.4 LDAP Module for System Authentication Potential
                          Security Vulnerability
                             15 November 2002

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                OSIS v5.4 LDAP Module for System Authentication
Vendor:                 Compaq
Operating System:       HP Tru64 UNIX V4.0G
                        HP Tru64 UNIX V4.0F
Impact:                 Increased Privileges
                        Access Privileged Data
Access Required:        Remote

Comment: The PGP signature for the Compaq bulletin was bad, however
         AusCERT have verified the authenticity of its contents.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SECURITY BULLETIN: SSRT2385 OSIS V5.4 LDAP Module for
                   System Authentication Potential Security
                   Vulnerability

REVISION: 0


NOTICE: There are no restrictions for distribution of this
        Bulletin provided that it remains complete and
intact.
 
RELEASE DATE:  13 November 2002

SEVERITY:  High
 
SOURCE:  Compaq Computer Corporation,
         a wholly-owned subsidiary of
         Hewlett-Packard Company and
         Hewlett-Packard Company HP Services
         Software Security Response Team

REFERENCE:  SSRT2385

PROBLEM SUMMARY:

         This bulletin will be posted to the support
         website within 24 hours of release to
         http://thenew.hp.com/country/us/eng/support.html
         Use the SEARCH IN feature box, enter SSRT2385 in
the
         search window.



   SSRT2385   LDAP    (Severity - High)

   A potential security vulnerability has been has been
identified in the
   Lightweight Directory Access Protocol (LDAP) Module for
System
   Authentication from Open Source Internet Solutions
   (OSIS) V5.4.  Later versions of OSIS have been renamed
Internet
   Express for Tru64 UNIX.

   The potential vulnerability may result in nonprivileged
users gaining
   unauthorized access to files or privileged access on the
system. This
   potential vulnerability may be in the form of local and
remote security
   domain risks.


 
VERSIONS IMPACTED:


   HP Tru64 UNIX V4.0G

   HP Tru64 UNIX V4.0F


NOT IMPACTED:

   HP-UX

   HP-MPE/ix

   HP NonStop Servers

   HP OpenVMS


 
RESOLUTION:

   Early Release Patches (ERPs) are now available for
   OSIS 5.4 LDAP Module for System Authentication for
   HP Tru64 UNIX V4.0F and V4.0G (Cluster and Non-clustered
   Systems) that provide a solution to this potential
   vulnerability.

       NOTE:
       Customers running the LDAP Module for System
Authentication
       on HP Tru64 UNIX 5.*/TruCluster 5.* should update
       to the version included with Internet Express
       V5.9 or later.

   Please review the README file for each patch prior to
installation.

   HP Tru64 UNIX V4.0G/TruCluster Server V1.6:
   PREREQUISITE: OSIS V5.4 LDAP Module for System
Authentication
   Patch Kit Name: OSISV54_SSRT2385_40G_PATCH.tar
   Kit Location:  
ftp://ftp1.support.compaq.com/public/unix/v4.0g/

   HP Tru64 UNIX V4.0F/TruCluster Server V1.6:
   PREREQUISITE: OSIS V5.4 LDAP Module for System
Authentication
   Patch Kit Name: OSISV54_SSRT2385_40F_PATCH.tar
   Kit Location:  
ftp://ftp1.support.compaq.com/public/unix/v4.0f/



After completing the update, HP and Compaq strongly
recommends that you perform an immediate backup of
the system disk so that any subsequent restore operations
begin with updated software. Otherwise, the updates must
be re-applied after a future restore operation. Also, if
at some future time the system is upgraded to a later
patch release or version release, reinstall the
appropriate ERP.


SUPPORT:

For further information, contact HP Services.
 
SUBSCRIBE:

To subscribe to automatically receive future Security
Advisories from the Software Security Response Team via
Electronic mail:
http://www.support.compaq.com/patches/mailing-list.shtml 
 
REPORT:

To report a potential security vulnerability with any HP or
Compaq supported product, send email to:
security-alert@hp.com



HP and Compaq appreciate your cooperation and patience. As
always, HP and Compaq urge you to periodically review your
system management and security procedures. HP and Compaq
will continue to review and enhance the security features
of its products and work with our customers to maintain and
improve the security and integrity of their systems.

"HP and Compaq are broadly distributing this Security
Bulletin in order to bring to the attention of users of the
affected Compaq products the important security information

contained in this Bulletin. HP and Compaq recommend that
all users determine the applicability of this information
to their individual situations and take appropriate action.
Neither HP nor Compaq warrant that this information is
necessarily accurate or complete for all user situations
and, consequently, neither HP nor Compaq will be
responsible for any damages resulting from user's use or
disregard of the information provided in this Bulletin."


(c)Copyright 2002 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical
or editorial errors or omissions contained herein. The
information in this document is subject to change without
notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks
of Hewlett-Packard Company in the United States and other
countries. Other product and company names mentioned herein
may be trademarks of their respective owners.

- -----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.4

iQA/AwUBPdR92DnTu2ckvbFuEQJq8QCg0/bj+ihA8R+vwN287towNbY93ZsAoIQ+
E5kDxXP+abHCGoYiLn1jUDH4
=xNI8
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBPdUQIih9+71yA2DNAQG9jwP/fCABVaLHdEsiLX9aKynnmZw8q5u+03U6
17+v6bcG2GbV5DhW3dcFcqSZwzr2ArLx7FMezIjJqpGWSao5uM9wvPBX0QsQkue/
k3YOspptxPp81g0kTT+/5HH4v4K8jZ436JiQMZ7y6yZlRtSgv2zjudmZ2fSYtRws
Kwr6lI5ajNw=
=PYs4
-----END PGP SIGNATURE-----