home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Forum of Incident Response & Security Teams
/
Forum_of_Incident_Response_and_Security_Teams_FIRST_October_1994.iso
/
teaminfo
/
ddnscc
/
9417.txt
< prev
next >
Wrap
Text File
|
1994-07-08
|
11KB
|
205 lines
**************************************************************************
Security Bulletin 9417 DISA Defense Communications System
May 10, 1994 Published by: DDN Security Coordination Center
(SCC@NIC.DDN.MIL) 1-(800) 365-3642
DEFENSE DATA NETWORK
SECURITY BULLETIN
The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security
Coordination Center) under DISA contract as a means of communicating
information on network and host security exposures, fixes, and concerns
to security and management personnel at DDN facilities. Back issues may
be obtained via FTP (or Kermit) from NIC.DDN.MIL [192.112.36.5]
using login="anonymous" and password="guest". The bulletin pathname is
scc/ddn-security-yynn (where "yy" is the year the bulletin is issued
and "nn" is a bulletin number, e.g. scc/ddn-security-9302).
**************************************************************************
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
! !
! The following important advisory was issued by the Automated !
! Systems Security Incident Support Team (ASSIST) and is being !
! relayed unedited via the Defense Information Systems Agency's !
! Security Coordination Center distribution system as a means !
! of providing DDN subscribers with useful security information. !
! !
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Automated Systems Security Incident Support Team
_____
___ ___ _____ ___ _____ | /
/\ / \ / \ | / \ | | / Integritas
/ \ \___ \___ | \___ | | < et
/____\ \ \ | \ | | \ Celeritas
/ \ \___/ \___/ __|__ \___/ | |_____\
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Bulletin 94-14
Release date: 6 May 1994, 0830 PM EDT
SUBJECT: Security vulnerability in Hewlett Packard (HP) UX
systems.
SUMMARY: A vulnerability exists in HP-UX systems running HP Vue
3.0. HP has issued the PHSS_4055 (for models 300/400) and
PHSS_4038 (for models 700/800) patches to fix the problem. The
patch can be obtained from the HP SupportLine Mail Service
using the following procedure:
To obtain the patch, send the following in the TEXT PORTION
OF THE MESSAGE to support@support.mayfield.hp.com
(no Subject is required):
send PHSS_4038
or
send PHSS_4055
It will automatically be emailed back to you. Note that
users may also download the patch from HP SupportLine via
ftp, kermit, or uucp.
The patch can be obtained via FTP with an established
SupportLine handle & password using the following procedure:
Telnet to 192.6.148.19 and login as hpsl. You will be prompted
for your system handle and password. You should then select
"3 Patch support information", followed by "3 Retrieve patch
file transfer login". This will give you an ftp login account.
Exit hpsl and ftp to 192.6.148.19. Use the account name you
received and your usual password.
The patch can be obtained via FTP without established SupportLine
handle & password using the following procedure:
If you do not already have an HP SupportLine handle and pass-
word, you must first telnet to support.mayfield.hp.com and log
into the HP SupportLine Self-Registration as "hpslreg", then
follow the on-screen prompts. At the end of the prompts, a
system handle and password will be assigned to you; you will
need these in the future to access the HP SupportLine located
in the United States. You can then follow the instructions in
paragraph 1a above.
NOTE: This procedure only registers for the HP SupportLine
system in the United States; users outside the U.S. need to
contact their local Hewlett Packard support representative.
If you need additional assistance and have a support contract, you
can contact your local Response Center for additional help.
BACKGROUND: A vulnerability has been discovered which allows non
privileged users of HP 9000 series machines with models
300/400/700/800 at HP-UX revision 9.X and running HP Vue 3.0 to
obtain root privileges. Other versions of HP-UX and HP Vue do not
have this vulnerability.
IMPACT: Unauthorized users can gain root access.
RECOMMENDED SOLUTION: Obtain and install the appropriate patch on
all affected HP systems. After you have the patch, list the file
with the command "more PHSS_40XX" (XX is 38 or 55) to verify it
is the most current version. If it has been replaced the
following will be displayed:
OBSOLETE
REPLACED
BY
PHSS_NNNN
The complete instructions for applying the patch are in
PHSS_40xx.text. Examine /tmp/update.log for any relevant WARNINGs
or ERRORs. This can be done as follows:
At the shell prompt, type "tail -60 /tmp/update.log | more".
Page through the next three screens via the space bar, looking
for WARNING or ERROR messages.
ASSIST is an element of the Defense Information Systems Agency
(DISA), Center for Information Systems Security (CISS), that
provides service to the entire DoD community. If you are a
constituent of the DoD and have any questions about ASSIST or
computer security issues, contact ASSIST using one of the methods
listed below. If your organization/institution is non-DoD,
contact your Forum of Incident Response and Security Teams
(FIRST) representative. You can obtain a list of FIRST member
organizations and their constituencies by sending email to
docserver@first.org with an empty "subject" line and a message body
containing the line "send first-contacts".
ASSIST INFORMATION RESOURCES: If you would like to be included in
the distribution list for these bulletins, send your Milnet
(Internet) e-mail address to assist-request@assist.ims.disa.mil.
Back issues of ASSIST bulletins, and other security related
information, are available from the ASSIST BBS at 703-756-7993/
1154 DSN 289, and through anonymous FTP from assist.ims.disa.mil
(IP address 137.130.234.30). Note: assist.ims.disa.mil will only
accept anonymous FTP connections from Milnet addresses that are
registered with the NIC or DNS.
ASSIST contact information:
PHONE: 703-756-7974, DSN 289, duty hours are 06:00 to 22:30 EST
Monday through Friday. During off duty hours, weekends, and
holidays, ASSIST can be reached via pager at 800-SKY-PAGE
(800-759-7243) PIN 2133937. Your page will be answered within 30
minutes, however if a quicker response is required, prefix
your phone number with "999".
ELECTRONIC MAIL: Send to assist@assist.ims.disa.mil.
ASSIST BBS: Leave a message for the "sysop".
Privacy Enhanced Mail (PEM): ASSIST uses PEM, a public key
encryption tool, to digitally sign all bulletins that are
distributed through e-mail. The section of seemingly random
characters between the "BEGIN PRIVACY-ENHANCED MESSAGE" and
"BEGIN ASSIST BULLETIN" contains machine-readable digital
signature information generated by PEM, not corrupted data. PEM
software for UNIX systems is available from Trusted Information
Systems (TIS) at no cost, and can be obtained via anonymous FTP
from ftp.tis.com (IP 192.94.214.100). Note: The TIS software is
just one of several implementations of PEM currently available and
additional versions are likely to be offered from other
sources in the near future.
Reference herein to any specific commercial products, process, or
service by trade name, trademark manufacturer, or otherwise, does
not constitute or imply its endorsement, recommendation, or
favoring by ASSIST. The views and opinions of authors expressed
herein shall not be used for adverstising or product endorsement
purposes.
****************************************************************************
* *
* The point of contact for MILNET security-related incidents is the *
* Security Coordination Center (SCC). *
* *
* E-mail address: SCC@NIC.DDN.MIL *
* *
* Telephone: 1-(800)-365-3642 *
* *
* NIC Help Desk personnel are available from 7:00 a.m.-7:00 p.m. EST, *
* Monday through Friday except on federal holidays. *
* *
****************************************************************************
PLEASE NOTE: Many users outside of the DOD computing communities receive
DDN Security bulletins. If you are not part of DOD community, please
contact your agency's incident response team to report incidents. Your
agency's team will coordinate with DOD. The Forum of Incident Response and
Security Teams (FIRST) is a world-wide organization. A list of FIRST member
organizations and their constituencies can be obtained by sending email to
docserver@first.org with an empty subject line and a message body containing
the line: send first-contacts.
This document was prepared as an service to the DOD community. Neither the
United States Government nor any of their employees, makes any warranty,
expressed or implied, or assumes any legal liability or responsibility for
the accuracy, completeness, or usefulness of any information, product, or
process disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products, process,
or service by trade name, trademark manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation, or favoring
by the United States Government. The opinions of the authors expressed herein
do not necessarily state or reflect those of the United States Government,
and shall not be used for advertising or product endorsement purposes.