FOR OFFICIAL DEPARTMENT OF ENERGY USE ONLY ======================================================================== || THE COMPUTER INCIDENT ADVISORY CAPABILITY || || || || C I A C || || || || INFORMATION NOTICE || ======================================================================== HP-UX Trusted Systems 6.5 or 7.0, Authorization Problem ------------------------------------------------------- Oct 24, 1990 1600 PST Number B-5 Summary:: Critical HP-UX Trusted Systems Facts - ---------------------------------------------------------------------------- PROBLEM: May allow non-privileged users to gain root access. PLATFORM: Hewlett Packard, Trusted Systems 6.5/7.0 DAMAGE: Allows unauthorized system modification. WORKAROUND: Ensure correct password files and use user names less than 8 characters. PATCH: H.P. is aware of this problem and has released patch P025, available from the HP Response Center or your local HP representative. SYSTEM IMPACT: Inconvenience of temporarily changing some user names. - ---------------------------------------------------------------------------- CIAC has learned of a serious security problem with Hewlett Packard Trusted Systems 6.5/7.0, which may allow non-privileged users to gain root access. Two problems exist within the user authentication (login) system. Both problems only effect the secure C2 version of HP-UX. If you are running Trusted Systems 6.5 or 7.0, then the vulnerability exists on your system. The two related vulnerabilities are: Problem 1 If you are running Trusted Systems HP-UX you must be absolutely sure that each entry in your /.secure/etc/passwd file matches an entry in your /etc/passwd file. If you have an entry in /.secure/etc/passwd, and not in /etc/passwd, the user will be authorized and given root privileges. Problem 2 A related vulnerability has to do with users that have 8 character user names. If any users have user names of 8 characters, you should change them to 7 or less characters until you install the patch described below. Solution The above modifications should be considered a temporary workaround. A permanent solution to both, is to obtain patch P025 from the HP Response Center, or your local HP Representative. For additional information or assistance, please contact CIAC, or your local HP Representative. David Brown (415) 423-9878 or (FTS) 543-9878 FAX: (415) 423-0913 or (FTS) 543-0913 or send e-mail to: ciac@tiger.llnl.gov Neither the United States Government nor the University of California nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government nor the University of California, and shall not be used for advertising or product endorsement purposes.