************************************************************************** Security Bulletin 9518 DISA Defense Communications System April 24, 1995 Published by: DDN Security Coordination Center (SCC@NIC.DDN.MIL) 1-(800) 365-3642 DEFENSE DATA NETWORK SECURITY BULLETIN The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security Coordination Center) under DISA contract as a means of communicating information on network and host security exposures, fixes, and concerns to security and management personnel at DDN facilities. Back issues may be obtained via FTP (or Kermit) from NIC.DDN.MIL [192.112.36.5] using login="anonymous" and password="guest". The bulletin pathname is scc/ddn-security-yynn (where "yy" is the year the bulletin is issued and "nn" is a bulletin number, e.g. scc/ddn-security-9428). ************************************************************************** + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + ! ! ! The following important advisory was issued by the Automated ! ! Systems Security Incident Support Team (ASSIST) and is being ! ! relayed unedited via the Defense Information Systems Agency's ! ! Security Coordination Center distribution system as a means ! ! of providing DDN subscribers with useful security information. ! ! ! + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Automated Systems Security Incident Support Team _____ ___ ___ _____ ___ _____ | / /\ / \ / \ | / \ | | / Integritas / \ \___ \___ | \___ | | < et /____\ \ \ | \ | | \ Celeritas / \ \___/ \___/ __|__ \___/ | |_____\ <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Bulletin 95-13 Release date: 21 April, 1995, 4:15 AM/PM EDT (GMT -4) SUBJECT: Three security vulnerabilities in the MPE/iX operating system. SUMMARY: The vulnerabilities detailed in this bulletin affect HP3000 (Hewlett Packard) Series 900 systems running any release of MPE through and including the Limited Release of MPE/iX 5.0 (X.50.20). BACKGROUND: The RECOMMENDED SOLUTION section below contains HP bulletin information for each of the three MPE/iX security vulnerabilities. Also included is information about how to obtain patches from HP and report security problems to the company. IMPACT: The security vulnerabilities in the MPE/iX operating system can be used by local users to gain unauthorized access privileges which may result in system compromise. RECOMMENDED SOLUTION: =============================================================== Description: Security Vulnerability (HPSBMP9503-003) in MPE/iX releases. The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. PROBLEM: Security vulnerability in the MPE/iX operating system PLATFORM: HP3000 Series 900 systems running any release of MPE through and including the Limited Release of MPE/iX 5.0 (X.50.20) DAMAGE: Users can gain additional privileges and/or special capabilities. SOLUTION: Update all systems to the General Release of MPE/iX 5.0, or Apply patch MPEHX26A (MPE/iX Release 4.0 B.40.00), or patch MPEHX26B (Limited Release MPE/iX 5.0 X.50.20) FIX: The problem is fixed in the General Release of MPE/iX 5.0 (C.50.00). AVAILABILITY: The 5.0 General Release and all patches are available now. Problem Description - ------------------- It has been found that HP 3000 systems running MPE/iX Release 4.0 (B.40.00), Release 4.5 (C.45.00), and the Limited Release of MPE/iX 5.0 (X.50.20) have a vulnerability that can be exploited by users to gain additional privileges and/or capabilities, but only if the users are already logged on to the system. This problem does not permit a user to gain additional privileges by accident. However, a user can exploit this vulnerability to gain System Manager (SM) capability. Fixing the problem - ------------------ Hewlett-Packard recommends that you update your HP 3000 Series 900 computer systems to the General Release of MPE/iX 5.0 (C.50.00), as this problem is fixed in that release. Updating to the 5.0 General Release is the easiest and safest way to get the fix for this security problem. Customers with HP System Support contracts should have already received their shipments of the General Release of MPE/iX 5.0 (C.50.00). However, if you feel that you cannot update to the 5.0 General Release at this time, the proper corrective measure depends on which release of MPE/iX your HP 3000 system is running. The vulnerability can be eliminated from Release 4.0 and the Limited Release of MPE/iX 5.0 by applying a patch, MPEHX26A or MPEHX26B. Release 4.5 (C.45.00) MUST be updated to the General Release of MPE/iX 5.0 (C.50.00), as no patch will be created for Release 4.5. No patches will be available for versions of MPE/iX prior to Release 4.0. Instead, you must update to a supported release. HP recommends that you update such systems to the General Release of MPE/iX 5.0. If you update to one of the other supported releases, you will have to follow the patch instructions described in the next section of this bulletin. How to Install the Patch (for MPE/iX 4.0 & Limited Release MPE/iX 5.0) - ---------------------------------------------------------------------- 1. Determine which patch is appropriate for your operating system release: MPEHX26A for Series 900, MPE/iX 4.0 (B.40.00) MPEHX26B for Series 900, Limited Release MPE/iX 5.0 (X.50.20) Impact of the patch and workaround - ---------------------------------- Application of the patch will eliminate the vulnerability. ======================================================================= Description: Security Vulnerability (HPSBMP9503-002) in MPE/iX releases The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. PROBLEM: Security vulnerability in the MPE/iX operating system PLATFORM: HP3000 Series 900 systems running the Limited Release of MPE/iX 5.0 DAMAGE: Users can gain access to a higher TurboImage privilege SOLUTION: Update all systems to the General Release of MPE/iX 5.0, or Apply patch MPEHX25A (Limited Release MPE/iX 5.0 X.50.20). FIX: The problem is fixed in the General Release of MPE/iX 5.0 (C.50.00) AVAILABILITY: The 5.0 General Release and all patches are available now. Problem Description - ------------------- It has been found that HP 3000 systems running the Limited Release of MPE/iX 5.0 (X.50.20) have a vulnerability that can be exploited by logged on users to gain a higher TurboImage privilege. This problem does not permit a user to gain additional privileges by accident. Fixing the problem - ------------------ Hewlett-Packard recommends that you update your HP 3000 Series 900 computer systems to the General Release of MPE/iX 5.0 (C.50.00), as this problem is fixed in that release. Updating to the 5.0 General Release is the easiest and safest way to get the fix for this security problem. Customers with HP System Support contracts should have already received their shipments of the General Release of MPE/iX 5.0 (C.50.00). However, if you feel that you cannot update to the 5.0 General Release at this time, the vulnerability can be eliminated from the Limited Release of MPE/iX 5.0 by applying a patch, MPEHX25A. How to Install the Patch (for the Limited Release MPE/iX 5.0) - ------------------------------------------------------------- 1. Determine which patch is appropriate for your operating system release: MPEHX25A for Series 900, Limited Release MPE/iX 5.0 (X.50.20) Impact of the patch and workaround - ---------------------------------- Application of the patch will eliminate the vulnerability. ======================================================================= Description: Security Vulnerability (HPSBMP9503-001) in MPE/iX releases The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. PROBLEM: Security vulnerability in the MPE/iX operating system PLATFORM: HP3000 Series 900 systems running Release 4.0, Release 4.5, and the 5.0 Limited Release of MPE/iX DAMAGE: Users can gain additional privileges and/or special capabilities SOLUTION: Update all systems to the General Release of MPE/iX 5.0, or Apply patch MPEHX24A (MPE/iX Release 4.0 B.40.00), or patch MPEHX24B (Limited Release MPE/iX 5.0 X.50.20) FIX: The problem is fixed in the General Release of MPE/iX 5.0 (C.50.00) AVAILABILITY: The 5.0 General Release and all patches are available now. Nature of the problem - --------------------- It has been found that HP 3000 systems running MPE/iX Release 4.0 (B.40.00), Release 4.5 (C.45.00), and the Limited Release of MPE/iX 5.0 (X.50.20) have a vulnerability that can be exploited by users to gain additional privileges and/or capabilities, but only if the users are already logged on to the system. This problem does not permit a user to gain additional privileges by accident. However, a user can exploit this vulnerability to gain System Manager (SM) capability. Fixing the problem - ------------------ Hewlett-Packard recommends that you update your HP 3000 Series 900 computer systems to the General Release of MPE/iX 5.0 (C.50.00), as this problem is fixed in that release. Updating to the 5.0 General Release is the easiest and safest way to get the fix for this security problem. Customers with HP System Support contracts should have already received their shipments of the General Release of MPE/iX 5.0 (C.50.00). However, if you feel that you cannot update to the 5.0 General Release at this time, the proper corrective measure depends on which release of MPE/iX your HP 3000 system is running. The vulnerability can be eliminated from Release 4.0 and the Limited Release of MPE/iX 5.0 by applying a patch, MPEHX24A/B. Release 4.5 (C.45.00) MUST be updated to the General Release of MPE/iX 5.0 (C.50.00), as no patch will be created for Release 4.5. How to Install the Patch (for MPE/iX 4.0 & Limited Release MPE/iX 5.0) - ---------------------------------------------------------------------- Determine which patch is appropriate for your operating system release: MPEHX24A for Series 900, MPE/iX 4.0 (B.40.00) MPEHX24B for Series 900, Limited Release MPE/iX 5.0 (X.50.20) Apply the patch to your MPE/iX system. Installation instructions are included with the MPE/iX SECURITY PATCH product. NOTE: IF YOU DECIDE TO APPLY ONE OF THE TWO PATCHES MENTIONED ABOVE RATHER THAN UPDATE YOUR HP 3000 TO THE GENERAL RELEASE OF MPE/iX 5.0, YOU MUST RE-APPLY ALL MPE/iX PATCHES PREVIOUSLY INSTALLED ON YOUR SYSTEM. Patch MPEHX24A/B replaces the Operating System SOM (OS SOM) in NL.PUB.SYS. This process has the effect of removing all previously installed MPE/iX patches from the OS SOM. You can obtain all prior General Release patches by ordering the current MPE/iX PowerPatch tape (B.40.09) for Release 4.0 or the current MPE/iX PowerPatch tape (X.50.24) for the Limited Release of 5.0. If you have an HP System Support contract, call your local Hewlett-Packard support contact. Otherwise, call your local HP Sales representative and order Product Number 50757A -- PowerPatch Tape. Be sure to indicate which version of the PowerPatch tape you require and the correct media type. PowerPatch tapes are available free of charge to customers who have an HP System Support contract and at a nominal charge to customers who do not. Impact of the patch and workaround - ---------------------------------- Application of the patch will eliminate the vulnerability (see (3) above). ===================================================================== How to Obtain HP Patches - ------------------------ If you have an HP System Support contract, you should be receiving a security notification packet that includes a FAX-back form for ordering the patches that fix the problems described in the following three Security Bulletins -- HPSBMP9503-001, HPSBMP9503-002, and HPSBMP9503-003. If you do not have an HP System Support contract, you can obtain the same patches by ordering MPE/iX SECURITY PATCH, Product Number B5116AA. This product is available at no charge. When ordering the product, you need to know which MPE/iX release you are patching and on what media you want the patch delivered. The following chart shows the two product options: Option Table for Product Number B5116AA 1600BPI 6250BPI Tape Tape DDS |---------|---------|---------| B.40.00 | 240,AA1 | 240,AA2 | 240,AAH | |---------|---------|---------| X.50.20 | 250,AA1 | 250,AA2 | 250,AAH | |---------|---------|---------| Phone numbers to HP Direct and other HP Country Sales offices have been included at the end of this bulletin for your convenience. 3. Applying the patch to your MPE/iX system. Installation instructions are included with the MPE/iX SECURITY PATCH product. Obtaining General Security Information To subscribe to automatically receive future NEW HP Security Bulletins from the HP SupportLine mail service via electronic mail, send an email message to: support@support.mayfield.hp.com (no Subject is required) Multiple instructions are allowed in the TEXT PORTION OF THE MESSAGE, here are some basic instructions you may want to use: To add your name to the subscription list for new Security Bulletins, send the following in the TEXT PORTION OF THE MESSAGE: subscribe security_info To retrieve the index of all HP Security Bulletins issued to date, send the following in the TEXT PORTION OF THE MESSAGE: send security_info_list World Wide Web service for browsing of bulletins is available via the HPSL URL: http://support.mayfield.hp.com Choose "Support news", then under Support news, choose "Security Bulletins" To report new security vulnerabilities, send email to: security-alert@hp.com <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ASSIST is an element of the Defense Information Systems Agency (DISA), Center for Information Systems Security (CISS), that provides service to the entire DoD community. Constituents of the DoD with questions about ASSIST or computer security security issues, can contact ASSIST using one of the methods listed below. Non-DoD organizations/institutions, contact the Forum of Incident Response and Security Teams (FIRST) (FIRST) representative. To obtain a list of FIRST member organizations and their constituencies send an email to docserver@first.org with an empty "subject" line and a message body containing the line "send first-contacts". ASSIST Information Resources: To be included in the distribution list for the ASSIST bulletins, send your Milnet (Internet) e-mail address to assist-request@assist.mil. Back issues of ASSIST bulletins, and other security related information, are available from the ASSIST BBS at 703-756-7993/1154 DSN 289-7993/1154, and through anonymous FTP from assist.mil (IP address 199.211.123.11). Note: assist.mil will only accept anonymous FTP connections from Milnet addresses that are registered with the NIC or DNS. ASSIST Contact Information: PHONE: 800-357-4231 (or 703-756-7974 DSN 289), duty hours are 06:00 to 22:30 EDT (GMT -4) Monday through Friday. During off duty hours, weekends and holidays, ASSIST can be reached via pager at 800-791- 4857. The page will be answered within 30 minutes, however if a quicker response is required, prefix the phone number with "999". ELECTRONIC MAIL: Send to assist@assist.mil. ASSIST BBS: Leave a message for the "sysop". Reference herein to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by ASSIST. The views and opinions of authors expressed herein shall not be used for advertising or product endorsement purposes. **************************************************************************** * * * The point of contact for MILNET security-related incidents is the * * Security Coordination Center (SCC). * * * * E-mail address: SCC@NIC.DDN.MIL * * * * Telephone: 1-(800)-365-3642 * * * * NIC Help Desk personnel are available from 7:00 a.m.-7:00 p.m. EST, * * Monday through Friday except on federal holidays. * * * **************************************************************************** PLEASE NOTE: Some users outside of the DOD computing communities may receive DDN Security bulletins. If you are not part of the DOD community, please contact your agency's incident response team to report incidents. Your agency's team will coordinate with DOD. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver@first.org with an empty subject line and a message body containing the line: send first-contacts. This document was prepared as an service to the DOD community. Neither the United States Government nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government. The opinions of the authors expressed herein do not necessarily state or reflect those of the United States Government, and shall not be used for advertising or product endorsement purposes.