Internet Standards/CD1.mdf/INET/SCC/9508

Text File | 1995-02-27 | 17.6 KB | 357 lines

******************************************************************************
Security Bulletin 9508                  DISA Defense Communications System
February 27, 1995         Published by: DDN Security Coordination Center
                                      ([e-mail])   1-[phone]

                        DEFENSE  DATA  NETWORK
                          SECURITY  BULLETIN

  The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security
  Coordination Center) under DISA contract as a means of communicating
  information on network and host security exposures, fixes, and concerns
  to security and management personnel at DDN facilities.  Back issues may
  be obtained via FTP (or Kermit) from NIC.DDN.MIL [192.112.36.5]
  using login="anonymous" and password="guest".  The bulletin pathname is
  scc/ddn-security-yynn (where "yy" is the year the bulletin is issued
  and "nn" is a bulletin number, e.g. scc/ddn-security-9505).
**************************************************************************
 + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
 | The following important  advisory was  issued by the Department of    |
 | Energy's Computer Incident Advisory Capability (CIAC), and is being   |
 | relayed unedited via the Defense Information Systems Agency's         |
 | Security Coordination Center  distribution  system  as a  means       |
 | of providing  DDN subscribers with useful security information.       |
 + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
            _____________________________________________________

                       The U.S. Department of Energy
                    Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
            _____________________________________________________

       INFORMATION BULLETIN

         HP-UX Malicious Code Sequences


February 23, 1995 1200 PST                                        Number F-14
_____________________________________________________________________________

PROBLEM: Malicious coding sequences can cause security vulnerabilities
  in HP-UX 9.x.
PLATFORMS: HP 9000 series 700/800s, for HP-UX version 9.x
DAMAGE:  Local users can gain unauthorized privileges.
SOLUTION:       Apply appropriate vendor patch as described below.
_____________________________________________________________________________

VULNERABILITY This vulnerability can cause the HP-UX Operating System to
ASSESSMENT: to crash or allow unauthorized access. CIAC urges affected
  sites to install the appropriate secuirty patch.
_____________________________________________________________________________

   Critical Information about HP-UX Malicious Code Sequences

CIAC has obtained information from Hewlett Packard regarding a new security
vulnerability involving malicious coding sequences which can be used to
compromise the security and/or integrity of a system. Specific patch details
are provided below.

The document ftp://ciac.llnl.gov/pub/ciac/bulletin/f-fy95/hppatchs.txt has
been updated to reflect this bulletin.  The hppatchs.txt document contains
the entire list of all HP Bulletins and patches.

IMPORTANT NOTE: Hewlett Packard updates patches periodically.  These updates
are not reflected in the text of each HP bulletin.  The overview presented
here contains current information on the patches available at the time of the
release of this CIAC bulletin.  If you request an updated patch, when you try
to retrieve the patch you will receive a message stating that the patch is
obsolete and the name of the patch which supersedes it.

Hewlett Packard has made sum and MD5 checksums available for their patches
and for their security bulletins.  See the detailed explanation for
HPSBUX9408-016 in CIAC bulletin F-02 for information on how to access and
utilize these checksums.

Following is the copy of the HP bulletin (HPSBUX9502-022):

[Begin HP Bulletin]
-------------------------------------------------------------------------------
Summary of 'Daily Security Bulletins Digest' documents
-------------------------------------------------------------------------------
Document Id    Description      Page 1
-------------------------------------------------------------------------------
HPSBUX9502-022 Security Vulnerability involving malicious users

===============================================================================
Detailed list of 'Daily Security Bulletins Digest' documents
===============================================================================
Document Id: [HPSBUX9502-022]
Date Loaded: [02-15-95]

Description: Security Vulnerability involving malicious users
===============================================================================

----------------------------------------------------------------------
      HEWLETT-PACKARD SECURITY BULLETIN: #00022, 15 February 95
----------------------------------------------------------------------

    The information in the following Security Bulletin should be acted
    upon as soon as possible. Hewlett-Packard will not be liable for
    any consequences to any customer resulting from customer's failure
    to fully implement instructions in this Security Bulletin as soon
    as possible.

----------------------------------------------------------------------
PROBLEM:  Security vulnerability involving malicious users
PLATFORM: HP 9000 series 700 and series 800 at revisions 9.X
DAMAGE:   Users can gain unauthorized privileges
SOLUTION: Apply the appropriate patch for your version of HP-UX
             For HP-UX 9.09+ (BLS), apply patch PHKL_5190,
                 HP-UX 9.09  (BLS), apply patch PHKL_5191,
                 HP-UX 9.08  (BLS), apply patch PHKL_5192,
                 HP-UX 9.05, apply patch PHKL_5049,
                 HP-UX 9.04, apply patch PHKL_5051,
                 HP-UX 9.03, apply patch PHKL_5049,
                 HP-UX 9.01, apply patch PHKL_5048,
                 HP-UX 9.0 , apply patch PHKL_5050.
AVAILABILITY: All patches are available now.

-----------------------------------------------------------------------------


  A. Problem

     Hewlett-Packard has discovered some malicious coding sequences that can
     cause the HP-UX Operating System to crash.  These coding sequences are
     malicious in origin and not representative of compiler generated code.
     The resulting system crash is not always predictable, depending heavily
     on the state of the system at the time of the attack.  Given this
     uncertainty, it is feasible that the security and/or integrity of the
     system might become compromised.

     Having identified this type of system vulnerability, HP has developed a
     patch that when installed provides the following countermeasures.
     First, it will protect your system from privilege violations that might
     be attempted using these malicious coding sequences.  Secondly, it
     strengthens the Operating System so that it is more resistant to this
     type of attack.  Should the attack succeed in crashing the system, this
     patch will in most cases report the identity of the process and user
     that executed the malicious coding sequences.  System Administrators
     can use this identification information to help track down the source
     of such attacks on their system.

  B. What the Patch Does

     This patch replaces key HP-UX library routines

  C. How to Get The Patch

     For HP-UX BLS product patches PHKL_5190, PHKL_5191 & PHKL_5192 are NOT
     electronically available.  For assistance in obtaining and installing
     this patch contact the HP Response Center at 1 [phone].
     Be sure to mention the keyword "BLS" to help route the call.

     All the other patches are available electronically.  You can retrieve a
     patch by using the service described below.

  D. How to Install The Patch

   1. Determine which patch is appropriate for your hardware platform and
      operating system:

      On the BLS product, HP-UX 9.08 (series 800) & HP-UX 9.09 (series 700),
      execute: what /hp-ux .

      On commercial products HP-UX 9.X (series 800) & HP-UX 9.X (series 700),
      execute: what /hp-ux .  Look for the product 9245XA (series 800) and
      B2352A  (series 700) to identify the revision currently running.

      Then use the table above to select the appropriate patch to request or
      retrieve.

   2. Hewlett Packard's HP-UX patches are available via email & WWW (MOSAIC)

        To obtain a copy of the HP SupportLine email service user's guide,
        send the following in the TEXT PORTION OF THE MESSAGE to
        [e-mail] (no Subject is required):

                      send guide

        The users guide explains the process for downloading HP-UX patches
        via email and other services available.


        WWW (MOSAIC) service (downloading of patches) is
        also available via WWW (MOSAIC) our URL is:
        (http://support.mayfield.hp.com)


   3. Apply the patch to your HP-UX system.

   4. Examine /tmp/update.log for any relevant WARNINGs or ERRORs.  This
      can be done as follows:

       a.  At the shell prompt, type "tail -60 /tmp/update.log | more"
       b.  Page through the next three screens via the space bar, looking
           for WARNING or ERROR messages.


  E. Impact of the patch and workaround

     No patches will be available for versions of HP-UX prior to 9.0.


  F. How to get Help

     If you need help installing a patch and have a Support Contract you
     can call the HP Response Center at 1 [phone].  If you have no
     Support Contract, call the same number and ask to make a "Helpline"
     call for assistance (payable via credit card).

   Since security patches are treated very carefully by HP yet are available
   free of charge, no additional information about the security issues
   addressed by these patches will be given.


  G. To subscribe to automatically receive future NEW HP Security Bulletins
     from the HP Support-Line mail service via electronic mail, send an
     e-mail message to:

      [e-mail]   (no Subject is required)

     Multiple instructions are allowed in the TEXT PORTION OF THE MESSAGE,
     here are some basic instructions you may want to use:

     * To add your name to the subscription list for new Security Bulletins,
       send the following in the TEXT PORTION OF THE MESSAGE:

                    subscribe security_info

     * To retrieve the index of all HP Security Bulletins issued to date,
       send the following in the TEXT PORTION OF THE MESSAGE:

                    send security_info_list

     WWW (MOSAIC) service (Browsing of Bulletins) is also available via WWW
     (MOSAIC) our URL is:

                    http://support.mayfield.hp.com

       Choose "Support news", then under Support news, choose "Security
       Bulletins"


  H. To report new security vulnerabilities, send email to

                  [e-mail]

-----------------------------------------------------------------------------
[End HP Bulletin]

CIAC is the computer security incident response team for the U.S.
Department of Energy.  Services are available free of charge to DOE and DOE
contractors.

DOE and DOE contractor sites can contact CIAC at:
    Voice:   510-422-8193
    FAX:     [phone]
    STU-III: 510-423-2604
    E-mail:  [e-mail]

Previous CIAC notices, anti-virus software, and other information are
available on the Internet via anonymous FTP from ciac.llnl.gov (IP address
128.115.19.53).

CIAC has several self-subscribing mailing lists for electronic publications:
1.  CIAC-BULLETIN for Advisories, highest priority - time critical
    information, and Bulletins, important computer security information;
2.  CIAC-NOTES for Notes, a collection of computer security articles;
3.  SPI-ANNOUNCE for official news about Security Profile Inspector (SPI)
    software updates, new features, distribution and availability;
4.  SPI-NOTES, for discussion of problems and solutions regarding the use of
    SPI products.

Our mailing lists are managed by a public domain software package called
ListProcessor, which ignores E-mail header subject lines. To subscribe (add
yourself) to one of our mailing lists, send requests of the following form:

subscribe list-name LastName, FirstName PhoneNumber

as the E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES,
SPI-ANNOUNCE or SPI-NOTES for "list-name" and valid information for
"LastName" "FirstName" and "PhoneNumber."  Send to: [e-mail]
not to: [e-mail]

e.g.,
subscribe ciac-notes O'Hara, Scarlett 404-555-1212 x36
subscribe ciac-bulletin O'Hara, Scarlett 404-555-1212 x36

You will receive an acknowledgment containing address and initial PIN, and
information on how to change either of them, cancel your subscription, or get
help.
_____________________________________________________________________________

PLEASE NOTE: Many users outside of the DOE and ESnet computing communities
receive CIAC bulletins. If you are not part of these communities, please
contact your agency's response team to report incidents. Your agency's team
will coordinate with CIAC. The Forum of Incident Response and Security Teams
(FIRST) is a world-wide organization. A list of FIRST member organizations
and their constituencies can be obtained by sending E-mail to
[e-mail] with an empty subject line and a message body
containing the line: send first-contacts.

This document was prepared as an account of work sponsored by an agency of
the United States Government. Neither the United States Government nor the
University of California nor any of their employees, makes any warranty,
expressed or implied, or assumes any legal liability or responsibility for
the accuracy, completeness, or usefulness of any information, product, or
process disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products, process,
or service by trade name, trademark manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation, or favoring
by the United States Government or the University of California. The views
and opinions of authors expressed herein do not necessarily state or reflect
those of the United States Government nor the University of California, and
shall not be used for advertising or product endorsement purposes.

_____________________________________________________________________________


****************************************************************************
*                                                                          *
*    The point of contact for MILNET security-related incidents is the     *
*    Security Coordination Center (SCC).                                   *
*                                                                          *
*               E-mail address: [e-mail]                            *
*                                                                          *
*               Telephone: [phone]                                *
*                                                                          *
*    NIC Help Desk personnel are available from 7:00 a.m.-7:00 p.m. EST,   *
*    Monday through Friday except on federal holidays.                     *
*                                                                          *
****************************************************************************

PLEASE NOTE: Some users outside of the DOD computing communities may receive
DDN Security bulletins.  If you are not part of  the DOD community, please
contact your agency's incident response team to report incidents.  Your
agency's team will coordinate with DOD.  The Forum of Incident Response and
Security Teams (FIRST) is a world-wide organization.  A list of FIRST member
organizations and their constituencies can be obtained by sending email to
[e-mail] with an empty subject line and a message body containing
the line: send first-contacts.

This document was prepared as an service to the DOD community.  Neither the
United States Government nor any of their employees, makes any warranty,
expressed or implied, or assumes any legal liability or responsibility for
the accuracy, completeness, or usefulness of any information, product, or
process disclosed, or represents that its use would not infringe privately
owned rights.  Reference herein to any specific commercial products, process,
or service by trade name, trademark manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation, or favoring
by the United States Government.  The opinions of the authors expressed herein
do not necessarily state or reflect those of the United States Government,
and shall not be used for advertising or product endorsement purposes.