copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Training
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2003.0107 -- HP Support Information Digests HPSBUX0202-184 -- Sec. Vulnerability in SNMP (rev. 16)

Date: 20 February 2003
References: ESB-2002.385  ESB-2002.422  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

      ESB-2003.0107 -- HP Support Information Digests HPSBUX0202-184
                   Sec. Vulnerability in SNMP (rev. 16)
                             20 February 2003

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                SNMP
Vendor:                 Hewlett-Packard
Platform:               HP 9000 Series 700/800 running HP-UX 10.x and 11.x
                        HP Procurve switches
                        HP TopTools Remote Control Card
                        JetDirect Firmware
                        MC/ServiceGuard, EMS HA Monitors
                        Solaris running OpenView or NNM
                        Windows/NT running OpenView or NNM
Impact:                 Denial of Service
                        Access Privileged Data
Access Required:        Remote

Ref:                    AL-2002.02
                        ESB-2002.422
                        ESB-2002.385

- --------------------------BEGIN INCLUDED TEXT--------------------

Document ID:  HPSBUX0202-184
Date Loaded:  20030218
      Title:  Sec. Vulnerability in SNMP (rev. 16)

- ----------------------------------------------------------------
  **REVISED 16**
   Source: HEWLETT-PACKARD COMPANY
   SECURITY BULLETIN: #0184,
   Originally issued: 12 Feb. 2002
   Last revision:     19 Feb. 2003
   Security Vulnerabilities in SNMP
 ----------------------------------------------------------------

The information in the following Security Bulletin should be acted
upon as soon as possible.  Hewlett-Packard Company will not be
liable for any consequences to any customer resulting from customer's
failure to fully implement instructions in this Security Bulletin as
soon as possible.

 ------------------------------------------------------------------
PROBLEM:  Vulnerabilities in SNMP request and trap handling.

**REVISED 16**
PLATFORM: HP 9000 Series 700 and Series 800 running HP-UX
                  releases 10.X and 11.X
          HP Procurve switches
          HP TopTools Remote Control Card
          JetDirect Firmware
          MC/ServiceGuard, EMS HA Monitors
   --->>  Solaris running OpenView NNM or OVO or SAM products
   --->>  Windows/NT running OpenView NNM or VPW or SAM products
   --->>  HP-UX running OpenView NNM or OVO/ITO or SAM products

DAMAGE:   Possible denial-of-service, service interruptions,
          unauthorized access.

**REVISED 16**
SOLUTION: Apply patches or implement workarounds.  See below.
          For HP-UX releases:

        PHSS_26510    s700_800  HP-UX  10.10, 10.01  Emanate 14.0
        PHSS_26137    s700_800  HP-UX 10.20 OV EMANATE14.2 Agent
        PHSS_27181    s700_800  HP-UX 10.20 OV EMANATE14.2 Agent
        PHSS_26367    s700_800  HP-UX 10.24 VirtualVault (VVOS)
        PHSS_26138    s700_800  HP-UX 11.X  OV EMANATE14.2 Agent
        PHSS_27182    s700_800  HP-UX 11.X  OV EMANATE14.2 Agent
        PHSS_26368    s700_800  HP-UX 11.04 VirtualVault (VVOS)

        PSOV_03087    Solaris 2.5.1, Solaris 2.6, Solaris 2.7
                      Solaris 2.8   EMANATE Release 14.2
        PSOV_03162    Solaris 2.5.1, Solaris 2.6, Solaris 2.7
                      Solaris 2.8   EMANATE Release 14.2

        PSOV_03113    Solaris 2.3, Solaris 2.4 Emanate Release 14.0

        For systems running OV NNM install the above SNMP
        patches for HP-UX and Solaris in addition to the NNM
        patches listed below.

        For Windows/NT install:
        NNM_00846     Windows NT4.0/4.01, Windows 2000
        NNM_00909     Windows NT4.0/4.01, Windows 2000

        NNM 6.2
        PHSS_26932    NNM 6.2   HP-UX 10.20
        PHSS_26933    NNM 6.2   HP-UX 11.X
        NNM_00890     NNM 6.2   Win NT/2k
        PSOV_03144    NNM 6.2   Solaris 2.X

        NNM 6.1 Note: both patches are required.
        PHSS_26918, PHSS_26908    NNM 6.1  HP-UX 10.20
        PHSS_26919, PHSS_26909    NNM 6.1  HP-UX 11.X
        NNM_00889, ECS_00011      NNM 6.1  Win NT/2k
        PSOV_03143, PSOV_03142    NNM 6.1  Solaris 2.5,
                                           2.6, 2.7, 2.8

  --->> NNM 6.0X
  --->> PHSS_27221    NNM6.0X   HP-UX 10.20
  --->> PHSS_27222    NNM6.0X   HP-UX 11.X
  --->> NT 4.X/Windows 2000:    NNM_00914
  --->> PSOV_03165    NNM6.0X   Solaris 2.5, 2.6, 2.7

        NNM 5.01
        PHSS_26806    NNM 5.01  HP-UX  10.20
        PSOV_03136    NNM 5.01  Solaris 2.X

  --->> NNM 5.02 (Windows NT 3.51/4.0)
  --->> NNM_00945     NNM5.0x   pmd/ovtrapd fixes

        NNM 4.11
        PHSS_26777    NNM 4.11  HP-UX  10.20
        PSOV_03132    NNM 4.11  Solaris 2.X

        OpenView Distributed Management 5.03
        PHSS_27273 - HP-UX 10.X
        PHSS_27274 - HP_UX 11.X
        PSOV_03173 - Solaris 2.X

        OpenView Distributed Management 6.0
        PHSS_27437 - HP-UX 10.X
        PHSS_27438 - HP_UX 11.00
        PSOV_03188 - Solaris 2.X

**REVISED 16**
MANUAL ACTIONS: Non-HP-UX only.   See HPSBUX0301-236

AVAILABILITY:   Patches for some affected systems are available now.

CHANGE SUMMARY: Rev.01 affected HP Procurve scope expanded,
                       plus Procurve patch availability added.
                       NNM ovtrapd patch availability added.
                Rev.02 SG and EMS found not vulnerable.
                Rev.03 JetDirect vulnerability updated
                Rev.04 NNM 5.X and VVOS patches, vulnerability note
                       for Solaris, and Windows NT.
                Rev.05 VVOS patch ID typo.
                Rev.06 Updating NNM 5.X section, HP OC SS7 added
                Rev.07 Added OpenView product status list
                Rev.08 Added NNM 5.01 and 4.11 patches for HP-UX
                       and Solaris
                Rev.09 New NNM 6.1 and NNM 6.2 patches, additional
                       Emanate patches, and TopTools Remote
                       Control Card information
                Rev.10 Additional Emanate and NNM patches.
                Rev.11 PHSS_27181,PHSS_27182, are only found on:
                       http://support.openview.hp.com/cpe/patches/
                Rev.12 OpenView Distributed Management 5.03
                       patches added.  Added pointer to HP Compaq
                       security advisory.
                Rev.13 Further expanded affected Procurve
                       switch scope.
                Rev.14 Added OpenView Distributed Management 6.0
                       patches.
                Rev.15 Modified Manual Actions field.
    --->>       Rev.16 Corrected Emanate, DM and NNM patches, added
                       final JetDirect f/w fix, OV/SAM products
                       finalized.
 ------------------------------------------------------------------

A. Background
    CERT has issued an advisory:
    CERT Advisory CA-2002-03 Multiple Vulnerabilities in Many
    Implementations of the Simple Network Management Protocol
    (SNMPv1) containing information about the vulnerabilities.

    Hewlett-Packard Company will revise this bulletin as new
    information becomes available.

    ---------------------------------------------------------
    HP Procurve switches
    ---------------------------------------------------------
    We have created fixes for products below which will resolve
    these issues.  See Section C below.


    ---------------------------------------------------------
    HP TopTools Remote Control Card
    ---------------------------------------------------------
    TopTools Remote Control (TTRC) card, rev. 2.0. (product
    P1218A) has an SNMP MIB defect.


    ---------------------------------------------------------
    NNM  (Network Node Manager)
    ---------------------------------------------------------
    Some problems found in NNM product were related to trap
    handling.  Patches are available.  See Section C below.


    ---------------------------------------------------------
     JetDirect Firmware
    ---------------------------------------------------------
    JetDirect Firmware Version      State
    ==========================      =====
        X.08.32 and lower           VULNERABLE
       (where X = A through K)
        X.21.00 and higher          NOT vulnerable
       (where X = L through P)

    ----------------------------------------------------------
    HP-UX Systems running snmpd or OpenView
    ----------------------------------------------------------
    Any HP-UX 10.X or 11.X system running snmpd or snmpdm is
    vulnerable.  To determine if your HP-UX system has snmpd
    or snmpdm installed:

           swlist -l file | grep snmpd


    ----------------------------------------------------------
    Other systems running OpenView or NNM
    ----------------------------------------------------------
    Solaris and Windows/NT systems running OpenView or NNM
    are vulnerable.

**REVISED 16**
    ----------------------------------------------------------
    OpenView Product         Status
    ----------------------------------------------------------
    NNM                   Vulnerable
                          Note:
  --->>                   All patches for NNM 6.2, NNM 6.1,
  --->>                   NNM6.0X, NNM 5.01, NNM 5.02, NNM 4.11,
  --->>                   and Emanate are now complete.
                          NNM also ships Emanate SNMP Agents
                          so patches for Emanate SNMP Agents
                          should also be applied (See section
                          "C. Recommended solution" below).
     ----------------------------------------------------------
     ITO/VPO/OVO on        Vulnerable
     Unix                  Patches released
                           Note:
                           This product bundles the NNM and
                           Emanate Agents with it. Appropriate
                           NNM and Emanate Agent patches should
                           also be applied. (See section
                           "C. Recommended solution" below).
     ----------------------------------------------------------
 -->>OVO Windows           Patches released
     VPW/OVO Windows       Note:
                           OVO bundles the NNM and Emanate Agents
                           with it.  Appropriate NNM and Emanate
                           agent patches should also be applied.
                           (See section "C. Recommended solution"
                           below).
     ----------------------------------------------------------
     Extensible Agent      Vulnerable
     (EA)                  Patches released
                           (See section "C. Recommended solution"
                           below).

     ----------------------------------------------------------
     Emanate SNMP Agents   Vulnerable
                           Patches released:
                           (See section "C. Recommended solution"
                           below).

**REVISED 16**
     ----------------------------------------------------------
- ---> OV/SAM Suite (including Storage Node Manger, Optimizer,
- --->               Allocator, Builder and Accountant).
- ---> ----------------------------------------------------------
- --->
- ---> The OV/SAM Suite components always acts as a SNMP client
- ---> (not an agent), with the single exception of SNMP traps,
- ---> discussed below.  As a client the question of agent
- ---> vulnerability does not apply.

- ---> OV/SAM Trap Handler:

- ---> The OV/SAM Suite provides a trap handler (using port 162)
- ---> to receive and process traps.  The 3.0 release of the product
- ---> is not vulnerable to denial of service attacks.

     ----------------------------------------------------------
- ---> OV/SA (Service Assurance)
- ---> OV/SA is based on DM 6.0 and requires that OV/DM 6.0 be
- ---> patched (see below).
     ----------------------------------------------------------
- ---> OV/OEMF (Open Element Management Framework)
- ---> OV/OEMF is based on OV/DM 5.03 and requires that OV/DM 5.03
- ---> be patched (see below).
     ----------------------------------------------------------

     DM                    DM Release 5.03 Vulnerable.
                           Patches released:
                           (See section "C. Recommended solution"
                           below).

                           DM Release 6.0 Vulnerable.
                           Patches released:
                           (See section "C. Recommended solution"
                           below).

    ----------------------------------------------------------

   Note: An HP Compaq security advisory (SSRT0779) is available
   at http://ftp.support.compaq.com/patches/.new/html/SSRT0779.shtml


B. Fixing the problem
   Install the appropriate patch or firmware revision or work
   around problem as detailed below.

C. Recommended solution
**REVISED 16**
 -->> Note - On HP-UX, running Security_Patch_Check as mentioned
 -->>        in section C (below) will help verify that all
 -->>        applicable security fixes have been implemented.

    ---------------------------------------------------------
    HP Procurve switches
    ---------------------------------------------------------

    Customers can download these patches in the form of software
    upgrades at:
              http://www.hp.com/rnd/software/switches.htm

             Product                        Fix revision number
    -----------------------------------     -------------------
    HP Procurve Switch 2524    (J4813A)       F.04.08 or greater
    HP Procurve Switch 2512    (J4812A)       F.04.08 or greater
    HP Procurve Switch 4108GL  (J4865A)       G.04.05 or greater
    HP Procurve Switch 4108GL-bundle (J4861A) G.04.05 or greater
    HP Procurve Switch 1600M  (J4120A)        C.09.13 or Greater
    HP Procurve Switch 2400M  (J4120A)        C.09.13 or Greater
    HP Procurve Switch 2424M  (J4122A)        C.09.13 or Greater
    HP Procurve Switch 4000M  (J4121A)        C.09.13 or Greater
    HP Procurve Switch 8000M  (J4110A)        C.09.13 or Greater

    ---------------------------------------------------------
    NNM  (Network Node Manager)
    ---------------------------------------------------------

**REVISED 16**
    Problems found in all NNM products are addressed in
    patches.  They are available at:

     http://support.openview.hp.com/cpe/patches/nnm/

     NNM 6.2  HP-UX 10.20             PHSS_26932
     NNM 6.2  HP-UX 11.X              PHSS_26933
     NNM 6.2  Win NT/2k               NNM_00890
     NNM 6.2  Solaris 2.X             PSOV_03144

     NNM 6.1  HP-UX 10.20           PHSS_26918, PHSS_26908
     NNM 6.1  HP-UX 11.X            PHSS_26919, PHSS_26909
     NNM 6.1  Win NT/2k             NNM_00889, ECS_00011
     NNM 6.1  Solaris 2.5, 2.6,
                    2.7, and 2.8    PSOV_03143, PSOV_03142
     Note: For NNM 6.1 both listed patches are required.


 --> For older NNM 6.0X, 5.0X, and 4.11 (HP-UX and Solaris
     versions only) see the list below, and obtain the patches
     from:

      http://support.openview.hp.com/cpe/patches/nnm/nnm.jsp

          NNM 4.11
          --------
          HP-UX 10.20       PHSS_26777
          Solaris 2.X       PSOV_03132

          NNM 5.01
          --------
          HP-UX 10.20       PHSS_26806
          Solaris 2.X       PSOV_03136

  --->>   NNM 5.02
  --->>   --------
  --->>   WinNT 3-4.X       NNM_00945

  --->>   NNM 6.0 and 6.01
  --->>   ---------------
  --->>   HP-UX 10.20       PHSS_27221
  --->>   HP-UX 11.00       PHSS_27222
  --->>   WinNT4.X/Win2000  NNM_00914
  --->>   Solaris 2.X       PSOV_03165

    ---------------------------------------------------------
      DM (OpenView Distributed Management)
    ---------------------------------------------------------
     Problems found in the OpenView Distributed Management 5.03
     are addressed in patches:

     PHSS_27273 - HP-UX 10.X
     PHSS_27274 - HP_UX 11.X
     PSOV_03173 - Solaris 2.X

     Problems found in the OpenView Distributed Management 6.0
     are addressed in patches:

     PHSS_27437 - HP-UX 10.X
     PHSS_27438 - HP_UX 11.00
     PSOV_03188 - Solaris 2.X

     All of these DM patches are available at:
     http://support.openview.hp.com/cpe/patches/dm/dm.jsp

    ---------------------------------------------------------
    MC/ServiceGuard
    ---------------------------------------------------------
     MC/ServiceGuard is not affected.  Testing has been completed
     and neither MC/ServiceGuard nor ServiceGuard OPS Edition are
     negatively impacted.

     The ServiceGuard Manager product does not use the cluster
     SNMP and remains unaffected.

    ---------------------------------------------------------
    Event Monitoring System  (EMS)
    ---------------------------------------------------------
     Testing of the MC/ServiceGuard or ServiceGuard OPS Edition
     application with package resources defined using EMS High
     Availability Monitors has been completed and shows no
     vulnerability to this issue.

    ---------------------------------------------------------
     HP TopTools Remote Control Card
    ---------------------------------------------------------
     TopTools Remote Control (TTRC) card, rev. 2.0. (product
     P1218A) has an SNMP MIB defect.  This is fixed in firmware
     version B.03.02 available at:

  http://h20004.www2.hp.com/keeper_rnotes/bsdmatrix/matrix62319.html

    ---------------------------------------------------------
     JetDirect Firmware
    ---------------------------------------------------------

**REVISED 16**
    JetDirect Firmware Version      State
    ==========================      =====
     X.08.32 and lower           VULNERABLE
      (where X = A through K)
     X.21.00 and higher          NOT vulnerable
      (where X = L through P)

 -->> FIX STATUS: The firmware fix is X.08.40 or newer.
      (where X = A through K)

 -->> The document describing this vulnerability and installation
 -->> of the firmware for affected devices is available at:
 -->> http://h20015.www2.hp.com/en/
             document.jhtml?lc=en&docName=bpj07122

          LIMITING THE VULNERABILITY

    SNMPv1 security relies on the set community name. It is
    important that a set-community-name be configured on the
    JetDirect device and that it be kept secret.

    JetDirect Print Servers offer an Access Control List that
    can be used to specify which hosts can make SNMP
    configuration changes to JetDirect Print Servers.

    The steps above can help prevent exploitation of the
    vulnerability.  To eliminate the vulnerability before a fix
    is available SNMP can be disabled on the JetDirect device.

         DISABLING SNMP ON A JETDIRECT PRINT SERVER

    1. Update the firmware to the highest level as described in
    the JetDirect Upgrade Instructions document:

 http://www.hp.com/cposupport/networking/support_doc/bpj06917.html

    NOTE:    Disabling SNMP may affect device discovery and port
             monitors that use SNMP to get status on the device.
             Use this feature with care.

    2.  Telnet to the JetDirect device (on the latest firmware)
    and type:
                   snmp-config: 0
                   quit

    This will completely disable SNMP on the JetDirect device.


    HP always recommends upgrading JetDirect firmware for the
    latest bug fixes and security benefits.  The upgrade firmware
    and download utility are available free of charge:

 http://www.hp.com/cposupport/networking/support_doc/bpj06917.html

    The following is a list of JetDirect Product Numbers
    that can be freely upgraded to X.08.32 or X.21.00 or
    higher firmware.  The latest firmware revision available
    for download is given.  For example, the latest firmware
    revision for the J3110A is G.08.32.

    EIO (Peripherals LaserJet 4000, 5000, 8000, etc...)
 --->>  J3110A 10T                          [G.08.40]
 --->>  J3111A 10T/10B2/LocalTalk           [G.08.40]
 --->>  J3112A Token Ring (discontinued)    [G.08.40]
 --->>  J3113A 10/100 (discontinued)        [G.08.40]
 --->>  J4169A 10/100                       [L.22.09]
 --->>  J4167A Token Ring                   [L.22.09]
        J6057A 10/100                       [R.22.09]

    MIO (Peripherals LaserJet 4, 4si, 5si, etc...)
 --->>  J2550A/B 10T (discontinued)                   [A.08.40]
 --->>  J2552A/B 10T/10Base2/LocalTalk (discontinued) [A.08.40]
 --->>  J2555A/B Token Ring (discontinued)            [A.08.40]
 --->>  J4100A 10/100                                 [K.08.40]
 --->>  J4105A Token Ring                             [K.08.40]
 --->>  J4106A 10T                                    [K.08.40]

    LIO (Peripherals Color InkJet cp1160, cp1700)
 --->>  J6042A 250m 10/100                      [N.22.09]

    External Print Servers
 --->>  J2591A EX+ (discontinued)               [E.08.40]
 --->>  J2593A EX+3 10T/10B2 (discontinued)     [D.08.40]
 --->>  J2594A EX+3 Token Ring (discontinued)   [D.08.40]
 --->>  J3263A 300X 10/100                      [H.08.40]
 --->>  J3264A 500X Token Ring                  [J.08.40]
 --->>  J3265A 500X 10/100                      [J.08.40]
        J6038A 310x USB 10/100                  [Q.22.04]

    ----------------------------------------------------------
    HP-UX Systems running snmpd or OpenView
    ----------------------------------------------------------
    The following patches are available now:

        PHSS_26510    s700_800  HP-UX  10.10, 10.01  Emanate 14.0
        PHSS_26137    s700_800  HP-UX 10.20 OV EMANATE14.2 Agent
        PHSS_27181    s700_800  HP-UX 10.20 OV EMANATE14.2 Agent
        PHSS_26367    s700_800  HP-UX 10.24 VirtualVault (VVOS)
        PHSS_26138    s700_800  HP-UX 11.X  OV EMANATE14.2 Agent
        PHSS_27182    s700_800  HP-UX 11.X  OV EMANATE14.2 Agent
        PHSS_26368    s700_800  HP-UX 11.04 VirtualVault (VVOS)

        PSOV_03087    Solaris 2.5.1, Solaris 2.6, Solaris 2.7
                      Solaris 2.8   EMANATE Release 14.2
        PSOV_03162    Solaris 2.5.1, Solaris 2.6, Solaris 2.7
                      Solaris 2.8   EMANATE Release 14.2
        PSOV_03113    Solaris 2.3, Solaris 2.4 Emanate Release 14.0

        For systems running OV NNM install above SNMP
        patches for HP-UX and Solaris.

        For Windows/NT install:
            NNM_00846    Windows NT4.0/4.01 Windows 2000
            NNM_00909    Windows NT4.0/4.01 Windows 2000

**REVISED 16**
 --->> PSOV_03087, PSOV_0162, NNM_00846, NNM_00909, PSOV_03113,
 --->> PSOV_03165, and PHSS_27181, PHSS_27182, PHSS_27221,
 --->> PHSS_27222 are available from:

           http://support.openview.hp.com/cpe/patches/

    PHSS_26367 and PHSS_26368 available from:
           http://itrc.hp.com

    PHSS_26510, PHSS_26137, and PHSS_26138 are available
    from both sites.

    The HP OC SS7 (OpenCall) products J3362A and J5938A running
    on HP-UX releases 10.20 and 11.X are not vulnerable if the
    applicable HP-UX patch listed above is installed.

  ============================================================
   NOTE: These patches are labeled OV (OpenView).  However, the
   patches are also applicable to systems that are _NOT_
   running OpenView.
  ============================================================

    Workaround for HP-UX Systems:

    If a patch is not available for your platform or you cannot
    install an available patch, snmpd and snmpdm can be disabled
    by removing their entries from /etc/services and removing the
    execute permissions from /usr/sbin/snmpd and /usr/sbin/snmpdm.


**REVISED16**
    ----------------------------------------------------------
- -->> HP-UX Systems running OV/SAM 3.0.1 Patch Release (only):
    ----------------------------------------------------------

 -->> Beginning with the OV/SAM 3.0.1 patch, the Microsoft SNMP
 -->> Trap Service is used (in order to share access to port 162).
 -->> Microsoft recommends a patch for SNMP
 -->>     NOTE: pre-3.0 versions of SAM (2.x versions) are not
 -->>     affected by this issue.  No action is required.
 -->>
 -->> This patch only applies to the OV/SAM management system (not
 -->> clients or host systems).  Therefore, only Windows 2000 will
 -->> be vulnerable and only with Service Pack 2 (Service Pack 2 is
 -->> the required software).  Microsoft has already included the
 -->> patch in Service Pack 3. OV/SAM 3.0 does support SP2 and SP3.
 -->>      For more information, refer to Microsoft's Web site:
 -->>
 -->> http://www.microsoft.com/technet/treeview/default.asp?url=
 -->>                /technet/security/bulletin/MS02-006.asp
 -->>
 -->>    Implement one of the following three potential solutions for
 -->>    OV/SAM 3.0.1:
 -->>
 -->> 1.  Uninstall Microsoft's SNMP trap service and restart
 -->>     OV/SAM's service.  OV/SAM will automatically revert to
 -->>     its 3.0 style of trap processing,
 -->>
 -->> 2.  Upgrade to Microsoft's Service Pack 3 (which includes the
 -->>     patch); again SAM 3.0 supports both SP2 and SP3,
 -->>
 -->> 3.  Install the patch from Microsoft.
 -->>     NOTE: pre-3.0 versions of SAM (2.x versions) are not
 -->>     affected by this issue.


D. To subscribe to automatically receive future NEW HP Security
   Bulletins from the HP IT Resource Center via electronic
   mail, do the following:

   Use your browser to get to the HP IT Resource Center page
   at:

       http://itrc.hp.com

   Use the 'Login' tab at the left side of the screen to login
   using your ID and password.  Use your existing login or the
   "Register" button at the left to create a login, in order to
   gain access to many areas of the ITRC.  Remember to save the
   User ID assigned to you, and your password.

   In the left most frame select "Maintenance and Support".

   Under the "Notifications" section (near the bottom of
   the page), select "Support Information Digests".

   To -subscribe- to future HP Security Bulletins or other
   Technical Digests, click the check box (in the left column)
   for the appropriate digest and then click the "Update
   Subscriptions" button at the bottom of the page.

    or

   To -review- bulletins already released, select the link
   (in the middle column) for the appropriate digest.

   NOTE: Using your itrc account security bulletins can be
         found here:
    http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin


   To -gain access- to the Security Patch Matrix, select
   the link for "The Security Bulletins Archive".  (near the
   bottom of the page)  Once in the archive the third link is
   to the current Security Patch Matrix. Updated daily, this
   matrix categorizes security patches by platform/OS release,
   and by bulletin topic.  Security Patch Check completely
   automates the process of reviewing the patch matrix for
   11.XX systems.

   For information on the Security Patch Check tool, see:
   http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
   displayProductInfo.pl?productNumber=B6834AA

   The security patch matrix is also available via anonymous
   ftp:

   ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/

   On the "Support Information Digest Main" page:
   click on the "HP Security Bulletin Archive".

E. To report new security vulnerabilities, send email to

    security-alert@hp.com

   Please encrypt any exploit information using the
   security-alert PGP key, available from your local key
   server, or by sending a message with a -subject- (not body)
   of 'get key' (no quotes) to security-alert@hp.com.

 ------------------------------------------------------------------

(c)Copyright 2003 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical or
editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of HP products referenced
herein are trademarks and/or service marks of Hewlett-Packard
Company.  Other product and company names mentioned herein may be
trademarks and/or service marks of their respective owners.

 ________________________________________________________________
- --
- -----End of Document ID:  HPSBUX0202-184--------------------------------------

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBPlTBBih9+71yA2DNAQF0PAP/Vt3jFvt2Fg0LVyyo0talFEwfylpuAuA7
QQBQ7c2K6Qs85ULejst0QzH6pprZ9eIHF5rri3pfQJO4AvmujRI0aQ8dwFqqHS1p
5Rim1ErGHxgqSLmaYDk9ytKPJAsYQIgW+LNh0CSXJU3fuYcGj6Wwv0NfConx1OtE
R9ojMv/TKYM=
=f1wo
-----END PGP SIGNATURE-----