**************************************************************************
Security Bulletin 9719 DISA Defense Communications System
July 10, 1997 Published by: DISN Security Coordination Center
(SCC@NIC.MIL)
1-(800) 365-3642
The DISN SECURITY BULLETIN is distributed by the DISN SCC (Security Coordination Center) under DISA contract as a means of communicating information on network and host security exposures, fixes, and concerns to security and management personnel at DISN facilities. Back issues may be obtained via FTP from NIC.MIL [207.132.116.5] using login= "anonymous" and password="guest". The bulletin pathname is scc/sec-yynn (where "yy" is the year the bulletin is issued and "nn" is a bulletin number, e.g. scc/sec-9705.txt). These are also available at our WWW site, http://nic.mil.
**************************************************************************
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
! !
! The following important advisory was issued by the Computer !
! Emergency Response Team (CERT) and is being relayed unedited !
! via the Defense Information Systems Agency's Security !
! Coordination Center distribution system as a means of !
! providing DISN subscribers with useful security information. !
! !
+ - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - +
=============================================================================
-----BEGIN PGP SIGNED MESSAGE-----
=============================================================================
July 9, 1997
To aid in the wide distribution of essential security information, the CERT Coordination Center is forwarding the following information from Hewlett-Packard Company. Hewlett-Packard contact information is included in the forwarded text below; please contact them if you have any questions or need further information.
Note: Hewlett-Packard reminds customers to use the HP Supportline
to check the patch matrix for current patch IDs. Because patches are cumulative, IDs change daily. The patch matrix is updated automatically every 24 hours.
- -------------------------------------------------------------------------
- -------------------------------------------------------------------------
The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett Packard will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible.
- -------------------------------------------------------------------------
DAMAGE: Vulnerabilities exists allowing local users to gain root
privileges.
SOLUTION: Apply patch:
PHCO_9595 for all platforms with HP-UX releases 9.X
PHCO_9596 for all platforms with HP-UX releases 10.00/10.01/10.10
PHCO_9597 for all platforms with HP-UX releases 10.20
AVAILABILITY: All patches are available now.
- -------------------------------------------------------------------------
A vulnerability with the chfn command (/usr/bin/chfn) has been discovered.
The vulnerability can be eliminated from HP-UX releases 9.X and 10.X by applying the appropriate patch.
1. Determine which patch are appropriate for your operating
system.
2. Hewlett-Packard's HP-UX patches are available via email
and the World Wide Web
To obtain a copy of the Hewlett-Packard SupportLine email service user's guide, send the following in the TEXT PORTION OF THE MESSAGE to support@us.external.hp.com (no Subject is required):
send guide
The users guide explains the HP-UX patch downloading process via email and other services available.
(http://us.external.hp.com)
3. Apply the patch to your HP-UX system.
4. Examine /tmp/update.log (9.X), or /var/adm/sw/swinstall.log
(10.X), for any relevant WARNING's or ERROR's.
The patches for HP-UX releases 9.X and 10.X provide enhancements to the chfn executable to avoid this vulnerability.
E. To subscribe to automatically receive future NEW HP Security Bulletins from the HP SupportLine Digest service via electronic mail, do the following:
1) From your Web browser, access the URL:
http://europe-support.external.hp.com (Europe)
3) On the "Welcome to HP's Support Information Digests" screen, under the heading "Register Now", select the appropriate hyperlink "Americas and Asia-Pacific", or "Europe".
4) On the "New User Registration" screen, fill in the fields for the User Information and Password and then select the button labeled "Submit New User".
** Note what your assigned user ID and password are for future reference.
6) You should now be on the "HP Support Information Digests Main" screen. You might want to verify that your email address is correct as displayed on the screen. From this screen, you may also view/subscribe to the digests, including the security bulletins digest.
To get a patch matrix of current HP-UX and BLS security patches referenced by either Security Bulletin or Platform/OS, click on following screens in order:
security-alert@hp.com
Please encrypt any exploit information using the
security-alert PGP key, available from your local key server,
or by sending a message with a -subject- (not body) of 'get key'
(no quotes) to security-alert@hp.com.
Permission is granted for copying and circulating this Bulletin to Hewlett-Packard (HP) customers (or the Internet community) for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to HP, and provided such reproduction and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. HP is not liable for any misuse of this information by any third party.
_______________________________________________________________________
If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in the Forum of Incident Response and Security Teams (FIRST). See http://www.first.org/team-info/.
We strongly urge you to encrypt any sensitive information you send by email. The CERT Coordination Center can support a shared DES key and PGP. Contact the CERT staff for more information.
Location of CERT PGP key
ftp://info.cert.org/pub/CERT_PGP.key
- ------------------------
Email cert@cert.org
Phone +1 412-268-7090 (24-hour hotline)
CERT personnel answer 8:30-5:00 p.m. EST
(GMT-5)/EDT(GMT-4), and are on call for
emergencies during other hours.
Fax +1 412-268-6989
CERT publications, information about FIRST representatives, and other
security-related information are available from
CERT advisories and bulletins are also posted on the USENET newsgroup
comp.security.announce
To be added to our mailing list for CERT advisories and bulletins, send your
email address to
cert-advisory-request@cert.org
In the subject line, type
SUBSCRIBE your-email-address
The CERT Coordination Center is part of the Software
Engineering Institute (SEI). The SEI is sponsored by the U. S.
Department of Defense.
****************************************************************************
* *
* *
* *
* *
* *
* *
* *
* *
****************************************************************************
PLEASE NOTE: Some users outside of the DOD computing communities may receive DISN Security Bulletins. If you are not part of the DOD community, please contact your agency's incident response team to report incidents. Your agency's team will coordinate with DOD. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver@first.org with an empty subject line and a message body containing the line: send first-contacts.
This document was prepared as an service to the DOD
community. Neither the United States Government nor any of their
employees, makes any warranty, expressed or implied, or assumes
any legal liability or responsibility for the accuracy, completeness,
or usefulness of any information, product, or process disclosed,
or represents that its use would not infringe privately owned
rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation, or favoring by the United States Government.
The opinions of the authors expressed herein do not necessarily
state or reflect those of the United States Government, and shall
not be used for advertising or product endorsement purposes.