From support@us.external.hp.com Wed Mar 13 01:01:24 1996 Date: Wed, 13 Mar 1996 01:09:20 -0800 From: HPSL Mail Service Reply to: support-feedback@us.external.hp.com To: Damien Sorder Subject: RE: send doc HPSBUX9402-005 -------- ## Regarding your request: Send Doc HPSBUX9402-005 The following are the results of your request from the HP SupportLine mail service. =============================================================================== Document Id: [HPSBUX9402-005] Date Loaded: [06-02-94] Description: Security Vulnerability in Hpterm =============================================================================== ----------------------------------------------------------------------- **REVISED 01**HEWLETT-PACKARD SECURITY BULLETIN: #00005, 01 June 94 ----------------------------------------------------------------------- _______________________________________________________________________ PROBLEM: **REVISED 01** Security vulnerability in hpterm executables at Revision 2.89 and earlier on all releases on HP-UX PLATFORM: HP 9000 series 300/400s and 700/800s DAMAGE: A vulnerability exists in hpterm. The vulnerability allows users to gain access to files regardless of ownership and permissions. SOLUTION: Apply the patch or patches to correct the vulnerability. AVAILABILITY: The patches are available now. CHANGE SUMMARY: New patch customize scripts greatly simplify procedure. _______________________________________________________________________ I. Hpterm Update A. Fixing the problem The patch customize scripts have been improved. The manual procedure given in the February 22, 1994 version of this bulletin is no longer needed. All that is necessary is to install the patches listed below. If you are running hp-ux revision 9.X, you will need both a Vue 3.0 and an hpterm patch. They can be installed in either order. 1. Determine which patches are appropriate for your hardware platform and operating system: PHSS_4067: s700_800/9.X hpterm AND PHSS_4066: s700_800/9.X VUE PHSS_4215: s300_400/9.X hpterm AND PHSS_4209: s300_400/9.X VUE PHSS_4213: s700/8.X hpterm PHSS_4214: s800/8.X hpterm PHSS_4212: s300_400/8.X hpterm These are the current patches as of June 1, 1994. You should list the patch: more PHSS_xxxx If it has been replaced there will be banner text saying: OBSOLETE REPLACED BY PHSS_NNNN These patches are cumulative, so the later version has all the previous fixes. This bulletin will not be updated with new patch numbers. 2. Get a copy of the patch from one of the following locations: a. HP SupportLine Mail Service To obtain the patch, send the following in the TEXT PORTION OF THE MESSAGE to support@support.mayfield.hp.com (no Subject is required): send patch_name for example: send PHSS_4066 It will automatically be emailed back to you. Note that users may also download the patch from HP SupportLine via ftp, kermit, or uucp. b. Response Center Support If you need additional assistance and have a support contract, you can contact your local Response Center for further help. 3. Apply the patch to your HP-UX system. The patch should be applied by root in the a state where VUE is not active (normally init state 2). The complete instructions for applying the patch are in PHSS_xxxx.text. 4. Examine /tmp/update.log for any relevant WARNINGs or ERRORs. This can be done as follows: a. At the shell prompt, type "tail -60 /tmp/update.log | more" b. Page through the next three screens via the space bar, looking for WARNING or ERROR messages. ----------------------------------------------------------------------- To subscribe to automatically receive NEW future HP Security Bulletins from the HP SupportLine mail service via electronic mail, send the following in the TEXT PORTION OF THE MESSAGE to support@support.mayfield.hp.com (no Subject is required): subscribe security_info To retrieve the index of all HP Security Bulletins, send the following: send security_info_list To obtain a copy of the HP SupportLine mail service user's guide, send the following: send guide.txt For security concerns, write to: security-alert@hp.com -----------------------------------------------------------------------