-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

            ESB-2003.0235 -- HEWLETT-PACKARD SECURITY BULLETIN
         Potential Buffer Overflows & Potential Denial of Service
                               02 April 2003

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                libc
                        RPC Libraries
                        CDE
                        X11
                        Various Basic Commands and Utilities
Vendor:                 Hewlett-Packard
Operating System:       Tru64 UNIX
Impact:                 Root Compromise
                        Denial of Service
Access Required:        Remote

Ref:                    ESB-2002.394
                        ESB-2002.369
                        ESB-2002.335
                        ESB-2002.319

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SECURITY BULLETIN  REVISION: 3 
 
 TITLE:
 ================================== 
SSRT2275 - HP Tru64 UNIX - Potential Buffer Overflows &
SSRT2229 Potential Denial of Service


NOTICE: There are no restrictions for distribution of this
              Bulletin provided that it remains complete and intact. 

RELEASE DATE: Rev 03 Released 1 April 2003
                                Rev 02 released   4 Sept. 2002
                                Rev 01 Released 30 August 2002


SEVERITY:  High

SOURCE:  HEWLETT-PACKARD COMPANY
                 Software Security Response Team

REFERENCE:  SSRT2257, SSRT-541, CERT (CA-2002-19,
CA-2002-20, CA-2002-23, CA-2002-25), SSRT2322,
SSRT2341, SSRT2384, SSRT2412, SSRT2439, SSRT2316,
HPSBUX0208-209 


 PROBLEM SUMMARY
 ==================================


 -->Rev 03: *Added solution information for HP Tru64 UNIX/TruCluster
Tru64 UNIX V5.1 PK6 (BL20) - April, 2003
 ===================================================


In addition to the buffer fixes described in the original security
bulletin,
the HP Tru64 UNIX/TruCluster V5.1 PK6 (BL20) ERP contains fixes
involving libc for the following potential security vulnerabilities:

The following potential security vulnerabilities have been identified
or
reported in the HP Tru64 UNIX operating system that may result in
unauthorized Privileged Access or a Denial of Service (DoS).
These potential vulnerabilities may be in the form of local and
remote security domain risks.

Severity is (HIGH) on all the potential vulnerabilities listed below:

SSRT2322 Bind resolver exploit in ISC 
SSRT2384 TCP exploit denies all RPC service 
SSRT2341 calloc() potential overflow 
SSRT2439 xdrmem_getbytes() potential overflow 
SSRT2412 portmapper hang after port scan with C2 enabled
(For additional information on the potential libc security
vulnerabilities,
refer to Security Bulletin  SSRT2322, 2341, 2384, 2412, 2439 -
HP Tru64 UNIX Potential libc Security Vulnerabilities 1 Apr. 2003)


- - - - -->REV 2: *Added solution information for
HP Tru64 UNIX/TruCluster V5.1a PK3 (BL3)  - September 4, 2002


This bulletin will be posted to the support website within 24 hours
of
release to -   http://thenew.hp.com/country/us/eng/support.html 
Use the SEARCH IN feature box, enter SSRT2275 in the search window.

SSRT2229 /usr/sbin/ping  (Severity - Medium)

 A potential security vulnerability has been reported within
HP Tru64 UNIX /ur/sbin/ping, which could potentially result in
denial of service (DoS). This may be in the form of local security
domain risks.

SSRT2275 HP Tru64 UNIX Buffer Overflows (Severity - see
specific list below)

Potential buffer overflows have been reported for HP Tru64 UNIX
where, under certain circumstances,  a non-privileged user may
gain unauthorized privileged access. This may be in the form of
local and remote security domain risks.



Basic Commands and Utilities (Severity - High)

SSRT2277 /usr/bin/ypmatch 
SSRT2261 /usr/sbin/traceroute 
SSRT2260 /usr/sbin/lpc 
SSRT2275 /usr/bin/lprm 
SSRT2275 /usr/bin/lpq 
SSRT2275 /usr/bin/lpr 
SSRT2275 /usr/lbin/lpd 
SSRT0796U /usr/bin/binmail 
SSRT0794U /usr/bin/ipcs 
SSRT2191 /usr/sbin/quot 
SSRT2189 /usb/bin/at 
SSRT2256 /usr/bin/ps 
SSRT2275 /usr/bin/uux 
      " /usr/bin/uucp 
      " /usr/bin/csh 
      " /usr/bin/rdist 
      " /usr/bin/mh/inc 
      " /usr/bin/mh/msgchk 
      " /usr/sbin/imapd 
      " /usr/bin/deliver 
      " /sbin/.upd..loader 

CDE (Severity - High)

SSRT2193 /usr/dt/bin/mailcv 
SSRT2280 /usr/dt/bin/dtterm 
SSRT2282 /usr/dt/bin/dtsession 
SSRT2274 /usr/dt/bin/rpc.ttdbserverd 
SSRT2251  

X11 (Severity - High)

SSRT2279 /usr/bin/X11/dxterm 
SSRT2275 /usr/bin/X11/dxconsole 
       " /usr/bin/X11/dxpause 
       " /usr/bin/X11/dxsysinfo 

Networking (Severity - High)

SSRT2340 /usr/sbin/telnetd
SSRT2270 BIND resolver glibc
SSRT2309 rpc XDR_ARRAY



 VERSIONS IMPACTED
 ==================================

     HP Tru64 UNIX V5.1A

     HP Tru64 UNIX V5.1

     HP Tru64 UNIX V5.0A

     HP Tru64 UNIX V4.0G

     HP Tru64 UNIX V4.0F


 NOT IMPACTED
 ==================================

     HP-UX

     HP-MPE/ix

     HP NonStop Servers

     HP OpenVMS
 
 RESOLUTION
 ==================================
 
Early Release Patches (ERPs) are now available for all supported
versions of HP Tru64 UNIX. The ERP kits use dupatch to install
and will not  install over any Customer-Specific-Patches (CSPs)
which have file intersections with the ERPs. Contact your normal
support channel and request HP Tru64 services elevate a case to
Support Engineering if a CSP must be merged with one of the
ERPs. Please review the README file for each patch prior to
installation. 


NOTE: These ERPs supercede ERPs delivered with the release
of SSRT2257 HP Tru64 UNIX /usr/bin/su buffer overflow potential
exploit August 1, 2002. Cross reference CERT VU#193347 and
SSRT-541 Tru64 UNIX CDE, NFS and NIS related Potential
Security Vulnerabilities April, 2002.


HP Tru64 UNIX/TruCluster V5.1A:
Prerequisite: V5.1A with PK3 (BL3) installed
ERP Kit Name: T64V51AB3-C0043701-15279-ES-20020828 .tar
Kit Location:  ftp://ftp1.support.compaq.com/public/unix/v5.1a/


HP Tru64 UNIX/TruCluster V5.1A:
Prerequisite: V5.1A with PK2 (BL2) installed
ERP Kit Name: T64V51AB2-C0041402-15271-ES-20020827 .tar
Kit Location:  ftp://ftp1.support.compaq.com/public/unix/v5.1a/ 


Tru64 UNIX/TruCluster 5.1
PREREQUISITE: V5.1 with PK6 (BL20) installed
ERP Kit Name: T64V51B20-C0173100-17539-ES-20030324.tar
Kit Location: http://ftp1.support.compaq.com/public/unix/v5.1/


HP Tru64 UNIX/TruCluster V5.1:
Prerequisite: V5.1 with PK5 (BL19) installed
ERP Kit Name: T64V51B19-C0136901-15143-ES-20020817 .tar
Kit Location:   ftp://ftp1.support.compaq.com/public/unix/v5.1/


HP Tru64 UNIX/TruCluster V5.0A:
Prerequisite: V5.0A with PK3 (BL17) installed
ERP Kit Name: T64V50AB17-C0018406-15268-ES-20020827 .tar
Kit Location:  ftp://ftp1.support.compaq.com/public/unix/v5.0a/


HP Tru64 UNIX/TruCluster V4.0G:
Prerequisite: V4.0G with PK3 (BL17) installed
ERP Kit Name: T64V40GB17-C0010410-15273-ES-20020827 .tar 
Kit Location:  ftp://ftp1.support.compaq.com/public/unix/v4.0g/



HP Tru64 UNIX/TruCluster V4.0F:
Prerequisite: V4.0F with PK7 (BL18) installed
ERP Kit Name: DUV40FB18-C0067405-15263-ES-20020827 .tar
Kit Location:  ftp://ftp1.support.compaq.com/public/unix/v4.0f/ 


Information on how to verify MD5 and SHA1 checksums is
available at: http://www.support.compaq.com/patches/whats-new.shtml


After completing the update, HP and Compaq strongly recommend that
you perform an immediate backup of  the system disk so that any
subsequent restore operations begin with updated software.
Otherwise, the updates must be re-applied after a future restore
operation.  Also, if at some future time the system is upgraded to a
later patch release or version release,  reinstall the appropriate
ERP.


SUPPORT: For further information, contact HP Services. 

SUBSCRIBE: To subscribe to automatically receive future Security
Advisories from the Software Security Response Team via electronic
mail:  http://www.support.compaq.com/patches/mail-list.shtml

REPORT: To report a potential security vulnerability with any HP
supported product, send email to: security-alert@hp.com


As always, HP urges you to periodically review your system management
and security procedures. HP will continue to review and enhance the
security features of its products and work with our customers to
maintain and improve the security and integrity of their systems.


"HP is broadly distributing this Security Bulletin in order to bring
to the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends
that all users determine the applicability of this information to
their
individual situations and take appropriate action. HP does not
warrant that this information is necessarily accurate or complete
for all user situations and, consequently, HP will not be responsible
for any damages resulting from user's use or disregard of the
information provided in this Bulletin."


(c)Copyright 2001, 2003 Hewlett-Packard Development Company, L.P. 
Hewlett-Packard Company shall not be liable for technical or
editorial errors or omissions contained herein. The information in
this
document is subject to change without notice. Hewlett-Packard
Company and the names of Hewlett-Packard products referenced
herein are trademarks of Hewlett-Packard Company in the United
States and other countries. Other product and company names
mentioned herein may be trademarks of their respective owners.

- -----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.1

iQA/AwUBPooaLDnTu2ckvbFuEQLDrQCdEvXwLqBd4lq0L53jV7fxv86CEbcAn2/q
haq5Sjfsa+dSzAxQjVX0XFUb
=NjA4
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBPortvyh9+71yA2DNAQGeSwP9G0TMFTeF48IKf6cLGSLidRxCx17NPf07
cOUBBMbeeWvgKdmRmmzljxwpHejpxyXuUiC32UnR16xmX3uL3no2CaFItElJjwg9
JDlfsyn2Q2JnJZT7VKerD4EWBMy8117SFT2IVOjljqNyQFw6DvgUmjKsXlPWcIam
dvgK5nLyEXg=
=CAiD
-----END PGP SIGNATURE-----