[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 566/03 - Four Hewlett-Packard Security Advisories



 
-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 566/03 dated 10.10.03  Time: 10:30
 UNIRAS is part of NISCC(National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------

Title
=====

Four Hewlett-Packard Security Advisories

1. Potential Security Vulnerabilities in HP WBEM Services for HP-UX.

2. Potential Security Vulnerability in SCM3.0.

3. Potential Security Vulnerabilities in HP-UX AAA Server

4. Potential Security Vulnerabilities Apache web server on HP-UX
   VVOS and Webproxy.  

Detail
====== 

1. Certain ASN.1 encodings that are rejected as invalid by the parser can 
by the parser can trigger a bug in the deallocation of the corresponding 
data structure, corrupting the stack.  This can be used as a denial of service
attack.         
            
2. Unauthorized access, increase in privilege or execution of arbitrary code.
          
3. Certain ASN.1 encodings that are rejected as invalid by the parser can trigger
a bug in the deallocation of the corresponding data structure, corrupting the
stack.  This can be used as a denial of service attack.  It is currently unknown            
whether this can be exploited to run malicious code.          
             
4. Potential Apache web server crash when it goes into an infinite loop due to too
many subsequent internal redirects and nested subrequests.           
            


1. ESB-2003.0708 -- HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0310-288
   SSRT3622 Potential Security Vulnerabilities in HP WBEM Services for HP-UX
                              10 October 2003


Product:                HP WBEM Services for HP-UX
Publisher:              Hewlett-Packard
Operating System:       HP-UX B.11.23
                        HP-UX B.11.11
                        HP-UX B.11.00
Platform:               HP9000
Impact:                 Denial of Service
Access Required:        Remote
CVE Names:              CAN-2003-0543 CAN-2003-0544 CAN-2003-0545

Ref:                    AL-2003.18

Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0310-288
Originally issued: 07 October 2003
SSRT3622 Potential Security Vulnerabilities in HP WBEM Services
         for HP-UX
 ----------------------------------------------------------------
NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.

The information in the following Security Bulletin should be
acted upon as soon as possible.  Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.

 -----------------------------------------------------------------
PROBLEM: 1. Certain ASN.1 encodings that are rejected as invalid
            by the parser can trigger a bug in the deallocation
            of the corresponding data structure, corrupting the
            stack.  This can be used as a denial of service
            attack.  It is currently unknown whether this can be
            exploited to run malicious code. This issue does not
            affect OpenSSL 0.9.6.

            More details are available at:
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0545

         2. Unusual ASN.1 tag values can cause an out of bounds
            read under certain circumstances, resulting in a
            denial of service vulnerability.
            More details are available at:
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0543
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0544

         3. A malformed public key in a certificate will crash
            the verify code if it is set to ignore public key
            decoding errors.  Exploitation of an affected
            application would result in a denial of service
            vulnerability.

         4. Due to an error in the SSL/TLS protocol handling,
            a server will parse a client certificate when one is
            not specifically requested.

IMPACT:   Potential Denial of Service

PLATFORM: HP9000 Servers running HP-UX release B.11.00, B.11.11,
          and B.11.23 with the following versions are affected:

        - HP WBEM Services for HP-UX, A.01.05.05 or earlier
          (B8465BA)

SOLUTION: For HP-UX releases B.11.00, B.11.11, and B.11.23
          download new HP WBEM Services, A.01.05.07 or
          subsequent for the HP-UX product from the ftp site.
          (See below for details).

MANUAL ACTIONS: Yes - Update

AVAILABILITY: Complete product bundles are available from the
              ftp site (see below), not on itrc.hp.com
              This bulletin will be updated when different
              delivery mechanisms become available.

 -----------------------------------------------------------------
A. Background
   An SSL/TLS testing suite developed by the NISCC (National
   Infrastructure Security Co-Ordination Centre in the UK) has
   identified ASN.1 parsing vulnerabilities in OpenSSL.

   The Common Vulnerabilities and Exposures project
   <http://cve.mitre.org/> has identified potential
   vulnerabilities which affect HP WBEM Services for HP-UX
   (CAN-2003-0543, CAN-2003-0544).

    HP WBEM Services for HP-UX (B8465BA)includes the following
    filesets.

    B8465BA                            HP WBEM Services for HP-UX
    B8465BA.WBEMServies                WBEM Services CORE Product
    B8465BA.WBEMServices.WBEM-CORE     WBEM Services CORE Fileset
                                              for hp 9000 servers
    B8465BA.WBEMServices.WBEM-CORE-COM WBEM Services COM Fileset
    B8465BA.WBEMServices.WBEM-MAN      WBEM Services MAN Fileset
    B8465BA.WBEMServices.WBEM-MX       WBEM Services MX Fileset


    AFFECTED VERSIONS
    ==================

    The following is a list by HP-UX revision of
    affected filesets or patches and fix information.
    To determine if a system has an affected version,
    search the output of "swlist -a revision -l fileset"
    for an affected fileset or patch, then determine if
    a fixed revision or applicable patch is installed.

    HP-UX B.11.00
    HP-UX B.11.11
    HP-UX B.11.23
    =============
    WBEMServices.WBEM-CORE
    HP WBEM Services, A.01.05.05 or earlier
    fix: install revision A.01.05.07 or subsequent

    END AFFECTED VERSIONS

    These products were based on OpenSSL 0.9.6i.

B. Recommended solution
   The OpenSSL group has released patches to fix the
   vulnerabilities in OpenSSL 0.9.6k.

   For customers using B8465BA, HP has incorporated OpenSSL 0.9.6k
   in the following product release:

   - HP WBEM Services for HP-UX, A.01.05.07

        System:    hprc.external.hp.com  (192.170.19.51)
        Login:     wbem123
        Password:  wbem123

        FTP Access: ftp://wbem123:wbem123@xxxxxxxxxxxxxxxxxxxx/
                or: ftp://wben123:wben123@xxxxxxxxxxxxx/
                or: ftp hprc.external.hp.com

        Note: There is an ftp defect in IE5 that may result in
               a browser hang.  To work around this:
        - Select Tools -> Internet Options -> Advanced
        - Un-check the option:
                  [ ] Enable folder view for FTP sites

    ==================================================
    To fix the problem:

    1. Determine the affected version.
    2. Download and verify the cksum or md5 sum.
    3. Install the appropriate HP WBEM Services depot.

     cksum:
     3308217914 58048
            ./B8465-90015.pdf
     1680490012 5841355
            ./B8465BA_A.01.05.07_HP-UX_B.11.00_32+64.depot.gz
     1354634907 5841390
            ./B8465BA_A.01.05.07_HP-UX_B.11.11_32+64.depot.gz
     2450032668 16418477
            ./B8465BA_A.01.05.07_HP-UX_B.11.23_IA+PA.depot.gz


       MD5:
        B0BD0568A078494EC4F1434DEF8FE252
            B8465-90015.pdf
        AE71452895C5C85F4344F98982C62DA1
            ./B8465BA_A.01.05.07_HP-UX_B.11.00_32+64.depot.gz
        D8D2D91E0F1B079C4F9B323440881246
            ./B8465BA_A.01.05.07_HP-UX_B.11.11_32+64.depot.gz
        9FA10EAC5098590C02DCE89964A7F47E
            ./B8465BA_A.01.05.07_HP-UX_B.11.23_IA+PA.depot.gz


   Check for HP WBEM Services Installation
   ---------------------------------------
   To determine if HP WBEM Services for HP-UX is installed on
   your system, use Software Distributor's swlist command.

   For example, the results of the command
     swlist -l product | grep -i WBEM

     WBEMServices    A.01.05.07     WBEM Services CORE Product

   For full information about system requirements and installing
   HP WBEM Services, refer to the HP WBEM Services Version 1.5
   Release Notes.

   Installation Steps
   ------------------
   - Download the depot for HP WBEM Services for HP-UX from
     the ftp site.
   - To update to the new version, login as root and use the
     swinstall command to install the product:
     swinstall -s <depotname>


   Removing HP WBEM Services for HP-UX Installation
   ------------------------------------------------
   Although not recommended, HP WBEM Services can be removed
   from your system using the Software Distributor's "swremove"
   command.  Removing HP WBEM Services can seriously affect
   the functionality of dependent products.


C. To subscribe to automatically receive future NEW HP Security
   Bulletins from the HP IT Resource Center via electronic
   mail, do the following:

   Use your browser to get to the HP IT Resource Center page
   at:

      http://itrc.hp.com

   Use the 'Login' tab at the left side of the screen to login
   using your ID and password.  Use your existing login or the
   "Register" button at the left to create a login, in order to
   gain access to many areas of the ITRC.  Remember to save the
   User ID assigned to you, and your password.

   In the left-most frame-select "Maintenance and Support."

   Under the "Notifications" section (near the bottom of
   the page), select "Support Information Digests."

   To -subscribe- to future HP Security Bulletins or other
   Technical Digests, click the check box (in the left column)
   for the appropriate digest and then click the "Update
   Subscriptions" button at the bottom of the page.

   or

   To -review- bulletins already released, select the link
   (in the middle column) for the appropriate digest.

   NOTE: Using your itrc account, security bulletins can be
         found here:
   http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin


   To -gain access- to the Security Patch Matrix, select
   the link for "The Security Bulletins Archive" (near the
   bottom of the page).  Once in the archive the third link is
   to the current Security Patch Matrix. Updated daily, this
   matrix categorizes security patches by platform/OS release,
   and by bulletin topic.  Security Patch Check completely
   automates the process of reviewing the patch matrix for
   11.XX systems.  Please note that installing the patches
   listed in the Security Patch Matrix will completely
   implement a security bulletin _only_ if the MANUAL ACTIONS
   field specifies "No."

   The Security Patch Check tool can verify that a security
   bulletin has been implemented on HP-UX 11.XX systems providing
   that the fix is completely implemented in a patch with no
   manual actions required.  The Security Patch Check tool cannot
   verify fixes implemented via a product upgrade.

   For information on the Security Patch Check tool, see:
   http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
   displayProductInfo.pl?productNumber=B6834AA

   The security patch matrix is also available via anonymous
   ftp:

   ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/

   On the "Support Information Digest Main" page:
   click on the "HP Security Bulletin Archive."

   The PGP key used to sign this bulletin is available from
   several PGP Public Key servers.  The key identification
   information is:

      2D2A7D59
      HP Security Response Team (Security Bulletin signing only)
      <security-alert@xxxxxx>
      Fingerprint =
        6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59

   If you have problems locating the key please write to
   security-alert@xxxxxxx  Please note that this key is
   for signing bulletins only and is not the key returned
   by sending 'get key' to security-alert@xxxxxxx


D. To report new security vulnerabilities, send email to

   security-alert@xxxxxx

   Please encrypt any exploit information using the
   security-alert PGP key, available from your local key
   server, or by sending a message with a -subject- (not body)
   of 'get key' (no quotes) to security-alert@xxxxxxx






2. ESB-2003.0709 -- HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0310-287
            SSRT3645 Potential Security Vulnerability in SCM3.0
                              10 October 2003

Product:                Servicecontrol Manager (SCM) 3.0
Publisher:              Hewlett-Packard
Operating System:       HP-UX B.11.11
                        HP-UX B.11.00
Platform:               HP 9000
Impact:                 Execute Arbitrary Code/Commands

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 ----------------------------------------------------------------
 Source: HEWLETT-PACKARD COMPANY
 SECURITY BULLETIN: HPSBUX0310-287
 Originally issued: 7 October 2003
 SSRT3645 Potential Security Vulnerability in SCM3.0
 -----------------------------------------------------------------
NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.

The information in the following Security Bulletin should be
acted upon as soon as possible.  Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.

 -----------------------------------------------------------------

PROBLEM:  MySQL version 3.23.39, which is delivered with
          Servicecontrol Manager (SCM) 3.0, has potential
          security vulnerabilities.

IMPACT:   Unauthorized access, increase in privilege or execution
          of arbitrary code.

PLATFORM: HP 9000 servers running HP-UX B.11.00 and B.11.11 only.

SOLUTION: Update the SCM central management server to use ixMySQL
          version 3.23.54 which is released by the HP Internet
          Express group.  (See below).
          Install ixMySQL version 3.23.54 or subsequent and
          configure the SCM central management server to use
          ixMySQL.

   Note:  This fix is only available if you are running
          SCM 3.0 or later.  Earlier versions of SCM
          must be upgraded prior to applying this fix.

MANUAL ACTIONS:  Yes - NonUpdate

AVAILABILITY:  The solution is included herein.
 -----------------------------------------------------------------
 A. Background
    Any version of Servicecontrol Manager (SCM) 3.0 (such as
    B.03.00.01) was shipped with a version of MySQL (3.23.39)
    which contains security defects.

    For more information, see:
       http://www.mysql.com/documentation/mysql/bychapter/
              index.html#News-3.23.54

    SCM 2.5 uses LDAP and is therefore unaffected by this issue.
    Systems using SCM 2.5 that were upgraded to B.03.00.00,
    B.03.00.01, B.03.00.02, B.03.00.03, or B.03.00.04 need to be
    upgraded further on any HP-UX B.11.00 or B.11.11 platform.
    Sytems running SCM 3.0 on HP-UX B.11.23 are not affected, as
    they use ixMySQL.


    AFFECTED VERSIONS
    =================
    The following is a list by HP-UX revision of
    affected filesets or patches and fix information.
    To determine if a system has an affected version,
    search the output of "swlist -a revision -l fileset"
    for an affected fileset or patch, then determine if
    a fixed revision or applicable patch is installed.


    HP-UX B.11.00
    HP-UX B.11.11
    =============
    mysql.MYSQL
    fix: install ixMySQL revision 3.23.54 or subsequent, and
         configure the SCM central management server to use
         ixMySQL.

    END AFFECTED VERSIONS


    NOTE: This problem does not impact HP NonStop Servers nor
          HP OpenVMS, nor HP Tru64 UNIX/Trucluster Server.

 B. Recommended solution
    If you are installing SCM 3.0 on a central management server
    for the first time, follow these installation instructions:

  1.  If SCM 3.0 is not B.03.00.01 or later, download the latest
      version on the Web at:
        http://software.hp.com/products/SCMGR/download.html
  2.  Install SCM:
        swinstall -s SCM3.0.x_depot -x reinstall=true B8339BA
  3.  Remove MySQL 3.23.39:
        swremove MySQL
  4.  After MySQL is removed, check if the mysqld daemon is
      still running:
        ps -ef | grep mysqld
      The mysqld daemon should not still be running.  If it is,
      stop it with:
        kill -9 <PIDofmysqld>
  5.  Install the new ixMySQL
      On HP-UX B.11.11
        swinstall -s ix_MySQL_depot ixMySQL
      On HP-UX B.11.00:
        swinstall -s depot -x allow_incompatible=true ixMySQL
        swconfig -x allow_incompatible=true ixMySQL
  6.  Configure SCM 3.0 to run with ixMySQL:
        /opt/mx/bin/mxinitconfig -a server

     If you need to update an existing central management server
     running SCM 3.0 with MySQL 3.23.39, follow these
     instructions:

  1.  Verify the version of SCM 3.0 (B8339BA):
        swlist B8339BA
      Note: Only B8339BA, B.03.00.01 or later is compatible
            with ixMySQL.  If you have B8339BA, B.03.00.00
            installed, you need to upgrade to B.03.00.01
            version or later and then complete this
            procedure.
  2.  Backup the SCM database to a file in a secure directory:
        /opt/mx/bin/mxrepositorysave -f $SAFEDIR/scm30save
  3.  Verify the backup file:
        ls -l $SAFEDIR/scm30save
  4.  Backup the MySQL files:
        tar cvf $SAFEDIR/mysql_files.tar /var/opt/mysq/mxcoredb/.
  5.  If the version of SCM is not B.03.00.01 or later, upgrade
      to the latest version of SCM.
    a.  Download the latest version on the Web at:
          http://www.software.hp.com/products/SCMGR/
    b.  Update SCM to the latest version:
          swinstall -s SCM3.0.x_depot -x reinstall=true B8339BA
  6.  Stop SCM daemons:
        /sbin/init.d/ServCtlMgr stop server
  7.  Remove MySQL 3.23.39:
        swremove MySQL
  8.  After MySQL is removed, check if the mysqld daemon is still
      running:
        ps -ef | grep mysqld
      The mysqld daemon should not still be running.  If it is,
      stop it with:
        kill -9 <PIDofMySQL>
  9.  Install ixMySQL.
      On HP-UX B.11.11
        swinstall -s ix_MySQL_depot ixMySQL
      On HP-UX B.11.00:
        swinstall -s depot -x allow_incompatible=true ixMySQL
        swconfig -x allow_incompatible=true ixMySQL
 10.  Configure SCM 3.0 to run with ixMySQL:
        /opt/mx/lbin/mxconfigrepo -a -F
 11.  Restore the SCM 3.0 data:
        /opt/mx/bin/mxrepositoryrestore -f $SAFEDIR/scm30save
 12.  Run SCM 3.0 with ixMySQL:
        /opt/mx/bin/mxinitconfig -a server


 C. To subscribe to automatically receive future NEW HP Security
    Bulletins from the HP IT Resource Center via electronic
    mail, do the following:

    Use your browser to get to the HP IT Resource Center page
    at:

       http://itrc.hp.com

    Use the 'Login' tab at the left side of the screen to login
    using your ID and password.  Use your existing login or the
    "Register" button at the left to create a login, in order to
    gain access to many areas of the ITRC.  Remember to save the
    User ID assigned to you, and your password.

    In the left most frame select "Maintenance and Support".

    Under the "Notifications" section (near the bottom of
    the page), select "Support Information Digests".

    To -subscribe- to future HP Security Bulletins or other
    Technical Digests, click the check box (in the left column)
    for the appropriate digest and then click the "Update
    Subscriptions" button at the bottom of the page.

    or

    To -review- bulletins already released, select the link
    (in the middle column) for the appropriate digest.

    NOTE: Using your itrc account security bulletins can be
          found here:
    http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin


    To -gain access- to the Security Patch Matrix, select
    the link for "The Security Bulletins Archive".  (near the
    bottom of the page)  Once in the archive the third link is
    to the current Security Patch Matrix. Updated daily, this
    matrix categorizes security patches by platform/OS release,
    and by bulletin topic.  Security Patch Check completely
    automates the process of reviewing the patch matrix for
    11.XX systems.  Please note that installing the patches
    listed in the Security Patch Matrix will completely
    implement a security bulletin _only_ if the MANUAL ACTIONS
    field specifies "No."

    The Security Patch Check tool can verify that a security
    bulletin has been implemented on HP-UX 11.XX systems providing
    that the fix is completely implemented in a patch with no
    manual actions required.  The Security Patch Check tool cannot
    verify fixes implemented via a product upgrade.

    For information on the Security Patch Check tool, see:
    http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
    displayProductInfo.pl?productNumber=B6834AA

    The security patch matrix is also available via anonymous
    ftp:

    ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/

    On the "Support Information Digest Main" page:
    click on the "HP Security Bulletin Archive".

    The PGP key used to sign this bulletin is available from
    several PGP Public Key servers.  The key identification
    information is:

       2D2A7D59
       HP Security Response Team (Security Bulletin signing only)
       <security-alert@xxxxxx>
       Fingerprint =
         6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59

    If you have problems locating the key please write to
    security-alert@xxxxxxx  Please note that this key is
    for signing bulletins only and is not the key returned
    by sending 'get key' to security-alert@xxxxxxx


 D. To report new security vulnerabilities, send email to

    security-alert@xxxxxx

    Please encrypt any exploit information using the
    security-alert PGP key, available from your local key
    server, or by sending a message with a -subject- (not body)
    of 'get key' (no quotes) to security-alert@xxxxxxx

 


 
3. ESB-2003.0710 -- HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0310-286
      SSRT3622 Potential Security Vulnerabilities in HP-UX AAA Server
                              10 October 2003


Product:                HP-UX AAA Server
Publisher:              Hewlett-Packard
Operating System:       HP-UX B.11.11
                        HP-UX B.11.00
Platform:               HP9000
Impact:                 Denial of Service
Access Required:        Remote
CVE Names:              CAN-2003-0543 CAN-2003-0544 CAN-2003-0545

Ref:                    AL-2003.18

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 -----------------------------------------------------------------
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0310-286
Originally issued: 07 Oct 2003
SSRT3622 Potential Security Vulnerabilities in HP-UX AAA Server
 -----------------------------------------------------------------
NOTICE: There are no restrictions for distribution of this
        Bulletin provided that it remains complete and intact.

The information in the following Security Bulletin should be
acted upon as soon as possible.  Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.

 -----------------------------------------------------------------
PROBLEM: 1. Certain ASN.1 encodings that are rejected as invalid
            by the parser can trigger a bug in the deallocation
            of the corresponding data structure, corrupting the
            stack.  This can be used as a denial of service
            attack.  It is currently unknown whether this can be
            exploited to run malicious code. This issue does not
            affect OpenSSL 0.9.6.

            More details are available at:
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0545

         2. Unusual ASN.1 tag values can cause an out of bounds
            read under certain circumstances, resulting in a
            denial of service vulnerability.
            More details are available at:
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0543
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0544

         3. A malformed public key in a certificate will crash
            the verify code if it is set to ignore public key
            decoding errors.  Exploitation of an affected
            application would result in a denial of service
            vulnerability.

         4. Due to an error in the SSL/TLS protocol handling,
            a server will parse a client certificate when one is
            not specifically requested.

IMPACT:   Potential Denial of Service

PLATFORM: HP9000 Servers running HP-UX release B.11.00, B.11.11
          with HP-UX AAA Server, A.06.01.02 or earlier,
          (AAAServer/T1428AA)
          This product included OpenSSL 0.9.7b.

SOLUTION: For HP-UX releases B.11.00, B.11.11, download new
          HP-UX AAA Server product from the ftp site
          (see below for details).

          For AAAServer/T1428AA download the following:

          - HP-UX AAA Server
            A.06.01.02.04 or later (AAAServer)
            This product includes OpenSSL 0.9.7b + patches.

MANUAL ACTIONS: Yes - Update
            Install the product containing the fix.
            Remove AAAServer (T1428AA) and migrate to
            HP-UX AAA Server A.06.01.02.04 or later.

AVAILABILITY: Complete product bundles are available from
              the ftp site (see below for details).

 -----------------------------------------------------------------
A. Background
   An SSL/TLS testing suite developed by the NISCC (National
   Infrastructure Security Co-Ordination Centre in the UK) has
   identified ASN.1 parsing vulnerabilities in OpenSSL.

   The HP-UX AAA Server (T1428AA) is affected by latest OpenSSL
   vulnerabilities.

     AFFECTED VERSIONS
     ==================

     The following is a list by HP-UX revision of
     affected filesets or patches and fix information.
     To determine if a system has an affected version,
     search the output of "swlist -a revision -l fileset"
     for an affected fileset or patch, then determine if
     a fixed revision or applicable patch is installed.

     The affected filesets are: (product.fileset)
     ==================
     HP-UX B.11.00
     HP-UX B.11.11
     AAAServer
     fix: install revision A.06.01.02.04 or subsequent

     END AFFECTED VERSIONS


B. Recommended solution
   For customers using the HP-UX AAA Server (T1428AA)
   revision A.06.01.02 and earlier download depots from:

        System:    hprc.external.hp.com  (192.170.19.51)
        Login:     acubed
        Password:  Acubed1

        FTP Access: ftp://acubed:Acubed1@xxxxxxxxxxxxxxxxxxxx/
                or: ftp://acubed:Acubed1@xxxxxxxxxxxxx/
                or: ftp hprc.external.hp.com

        Note: There is an ftp defect in IE5 that may result in
               a browser hang.  To work around this:
        - Select Tools -> Internet Options -> Advanced
        - Un-check the option:
                  [ ] Enable folder view for FTP sites

    ==================================================
    To fix the problem:

    1. Determine the affected version.
    2. Download and verify the cksum or md5 sum.
    3. Remove HP-UX AAA Server (T1428AA)
    4. Install the appropriate HP-UX AAA Server depot.

     cksum:
            64192605 10547857 T1428AA_A6124_11.00.depot.tar.gz
            55905138 10548515 T1428AA_A6124_11.11.depot.tar.gz
     md5:
          DE4E6B8937A4981D1982C364221959E5
                              T1428AA_A6124_11.00.depot.tar.gz
          99E7375C05AD6F4A4D51F4E2BC57A04F
                              T1428AA_A6124_11.11.depot.tar.gz

         The fix requires removing AAAServer (T1428AA) from
         the system and migrating to HP-UX AAA Server
         A.06.01.02.04 or later.


   Check for AAA Installation
   --------------------------
   To determine if the HP-UX AAA Server is installed on
   your system, use Software Distributor's swlist command.

   For example, the results of the command
     swlist -l product | grep -i AAA     might show:

   AAAServer  A.06.01.02    AAA Server

   Stop HP-UX AAA Server
   ---------------------
   Before updating, make sure to stop any previous HP-UX AAA
   Server binary.  Otherwise, the previous binary will continue
   running, preventing the new one from starting, although the
   installation may be successful.

   After determining which HP-UX AAA Server is installed, stop
   the process with the following command:

    kill `cat /var/opt/aaa/run/radiusd.pid | awk '{print $1}'`

    Stop any active tomcat processes using the following command:

    /opt/hpws/tomcat/bin/shutdown.sh

   Download and Install HP-UX AAA Server
   -----------------------------
   - Download HP-UX AAA Server depot file from the temporary ftp
     site using the previously mentioned links.
   - Unzip and extract the tar file.
   - Verify successful download by comparing the cksum/md5 with
     the value specified herein.
   - Register the depot using "swreg" and install using the
     "swinstall" SD commands.
   - Remove AAAServer (T1428AA) and migrate to
     HP-UX AAA Server A.06.01.02.04 or later.

    Installation of this new version of HP-UX AAA Server
    over an existing HP-UX AAA Server installation is supported,
    while installation over any non-HP AAA Server is NOT
    supported.

   Removing an HP-UX AAA Server Installation
   ----------------------------
   If you rather remove HP-UX AAA Server from your system than
   install a newer version to resolve the security problem, use
   both Software Distributor's "swremove" command.

   Note: Before executing swremove, stop HP-UX AAA Server and
   the active tomcat processes.

   Remove the HP-UX AAA Server using SD command: swremove T1428AA


C. To subscribe to automatically receive future NEW HP Security
   Bulletins from the HP IT Resource Center via electronic
   mail, do the following:

   Use your browser to get to the HP IT Resource Center page
   at:

      http://itrc.hp.com

   Use the 'Login' tab at the left side of the screen to login
   using your ID and password.  Use your existing login or the
   "Register" button at the left to create a login, in order to
   gain access to many areas of the ITRC.  Remember to save the
   User ID assigned to you, and your password.

   In the left most frame select "Maintenance and Support".

   Under the "Notifications" section (near the bottom of
   the page), select "Support Information Digests".

   To -subscribe- to future HP Security Bulletins or other
   Technical Digests, click the check box (in the left column)
   for the appropriate digest and then click the "Update
   Subscriptions" button at the bottom of the page.

   or

   To -review- bulletins already released, select the link
   (in the middle column) for the appropriate digest.

   NOTE: Using your itrc account security bulletins can be
         found here:
   http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin


   To -gain access- to the Security Patch Matrix, select
   the link for "The Security Bulletins Archive".  (near the
   bottom of the page)  Once in the archive the third link is
   to the current Security Patch Matrix. Updated daily, this
   matrix categorizes security patches by platform/OS release,
   and by bulletin topic.  Security Patch Check completely
   automates the process of reviewing the patch matrix for
   11.XX systems.  Please note that installing the patches
   listed in the Security Patch Matrix will completely
   implement a security bulletin _only_ if the MANUAL ACTIONS
   field specifies "No."

   The Security Patch Check tool can verify that a security
   bulletin has been implemented on HP-UX 11.XX systems providing
   that the fix is completely implemented in a patch with no
   manual actions required.  The Security Patch Check tool cannot
   verify fixes implemented via a product upgrade.

   For information on the Security Patch Check tool, see:
   http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
   displayProductInfo.pl?productNumber=B6834AA

   The security patch matrix is also available via anonymous
   ftp:

   ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/

   On the "Support Information Digest Main" page:
   click on the "HP Security Bulletin Archive".

   The PGP key used to sign this bulletin is available from
   several PGP Public Key servers.  The key identification
   information is:

      2D2A7D59
      HP Security Response Team (Security Bulletin signing only)
      <security-alert@xxxxxx>
      Fingerprint =
        6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59

   If you have problems locating the key please write to
   security-alert@xxxxxxx  Please note that this key is
   for signing bulletins only and is not the key returned
   by sending 'get key' to security-alert@xxxxxxx


D. To report new security vulnerabilities, send email to

   security-alert@xxxxxx

   Please encrypt any exploit information using the
   security-alert PGP key, available from your local key
   server, or by sending a message with a -subject- (not body)
   of 'get key' (no quotes) to security-alert@xxxxxxx

 -----------------------------------------------------------------





4.ESB-2003.0711 -- HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0310-285
  SSRT3642 Potential Security Vulnerabilities Apache web server on HP-UX
                            VVOS and Webproxy.
                              10 October 2003


Product:                Virtualvault 4.5
                        Virtualvault 4.6
                        Webproxy 2.0
Publisher:              Hewlett-Packard
Operating System:       HP-UX release B.11.04
Platform:               HP9000
Impact:                 Denial of Service
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 -----------------------------------------------------------------
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0310-285
Originally issued: 07 October 2003
SSRT3642 Potential Security Vulnerabilities Apache web server on
         HP-UX VVOS and Webproxy.
 -----------------------------------------------------------------

NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.

The information in the following Security Bulletin should be
acted upon as soon as possible.  Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.

 -----------------------------------------------------------------
PROBLEM: 1. Potential Apache web server crash when it goes into
            an infinite loop due to too many subsequent internal
            redirects and nested subrequests. (VU#379828)

         2. No de-allocation of file descriptors while servicing
            CGI scripts through child processes.

IMPACT:   Potential crash of Apache web server.

PLATFORM: HP9000 Servers running HP-UX release B.11.04 (VVOS)
          with Virtualvault A.04.50 or Virtualvault A.04.60
          installed.

SOLUTION: For Virtualvault and Webproxy releases install
          recommended patches.

           Virtualvault 4.5:
           PHSS_29541  s700_800 11.04 Virtualvault 4.5 IWS Update
           PHSS_29545  s700_800 11.04 Virtualvault 4.5 OWS update

           Virtualvault 4.6:
           PHSS_29542  s700_800 11.04 Virtualvault 4.6 IWS update
           PHSS_29546  s700_800 11.04 Virtualvault 4.6 OWS update

           Webproxy 2.0:
           PHSS_29547  s700_800 11.04 Webproxy server 2.0 update

MANUAL ACTIONS: No

AVAILABILITY: All patches are available now on <itrc.hp.com>.
 -----------------------------------------------------------------
 A. Background
    Virtualvault 4.5, Virtualvault 4.6, Webproxy 2.0: all use
    Apache 1.3.27.

    The Apache Web Server Project
      <http://www.apache.org/dist/httpd/Announcement.html> has
    identified potential vulnerabilities in the Apache HTTP
    Server.


     AFFECTED VERSIONS
     =================
     The following is a list by HP-UX revision of
     affected filesets or patches and fix information.
     To determine if a system has an affected version,
     search the output of "swlist -a revision -l fileset"
     for an affected fileset or patch, then determine if
     a fixed revision or applicable patch is installed.


     The affected filesets are: (product.fileset)

     Virtualvault A.04.50
     VaultTS.VV-IWS,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VVOS-ADM-RUN,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-CORE-CMN,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultWS.WS-CORE,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-JK,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-GUI,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-CORE-CMN,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-JAVA,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP

     Virtualvault A.04.60
     VaultTS.VV-IWS,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP
     VaultWS.WS-CORE,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-CORE-CMN,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-JAVA,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-GUI,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP

 HP Webproxy A.02.00
 HP_Webproxy.HPWEB-PX-CORE,fr=A.02.00,fa=HP-UX_B.11.04_32/64,v=HP

     fix: install
         Virtualvault 4.5: PHSS_29541 PHSS_29545 or subsequent
         Virtualvault 4.6: PHSS_29542 PHSS_29546 or subsequent
         Webproxy 2.0:     PHSS_29547 or subsequent

     END AFFECTED VERSIONS

    The Apache web server version 1.3.28 incorporates fix for the
    following problems:

     1. VU#379828: The server could crash when going into an
        infinite loop due to too many subsequent internal
        redirects and nested subrequests.

     2. No de-allocation of file descriptors while servicing CGI
        scripts through child processes.

    NOTE: This problem does not impact HP NonStop Servers,
          HP OpenVMS, nor the HP Tru64 UNIX/Trucluster Server.


 B. Recommended solution

       Install HP Apache versions 1.3.28

       The fixes for the following Virtualvault and Webproxy
       releases are available with the following patches:

       Virtualvault 4.5:
           PHSS_29541: s700_800 11.04 Virtualvault 4.5 IWS Update
           PHSS_29545: s700_800 11.04 Virtualvault 4.5 OWS update

       Virtualvault 4.6:
           PHSS_29542: s700_800 11.04 Virtualvault 4.6 IWS update
           PHSS_29546: s700_800 11.04 Virtualvault 4.6 OWS update

        Webproxy 2.0:
           PHSS_29547  s700_800 11.04 Webproxy server 2.0 update


 C. To subscribe to automatically receive future NEW HP Security
    Bulletins from the HP IT Resource Center via electronic
    mail, do the following:

    Use your browser to get to the HP IT Resource Center page
    at:

       <http://itrc.hp.com>

    Use the 'Login' tab at the left side of the screen to login
    using your ID and password.  Use your existing login or the
    "Register" button at the left to create a login, in order to
    gain access to many areas of the ITRC.  Remember to save the
    User ID assigned to you, and your password.

    In the left most frame select "Maintenance and Support".

    Under the "Notifications" section (near the bottom of
    the page), select "Support Information Digests".

    To -subscribe- to future HP Security Bulletins or other
    Technical Digests, click the check box (in the left column)
    for the appropriate digest and then click the "Update
    Subscriptions" button at the bottom of the page.

    or

    To -review- bulletins already released, select the link
    (in the middle column) for the appropriate digest.

    NOTE: Using your itrc account security bulletins can be
          found here:
    <http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin>


    To -gain access- to the Security Patch Matrix, select
    the link for "The Security Bulletins Archive".  (near the
    bottom of the page)  Once in the archive the third link is
    to the current Security Patch Matrix. Updated daily, this
    matrix categorizes security patches by platform/OS release,
    and by bulletin topic.  Security Patch Check completely
    automates the process of reviewing the patch matrix for
    11.XX systems.  Please note that installing the patches
    listed in the Security Patch Matrix will completely
    implement a security bulletin _only_ if the MANUAL ACTIONS
    field specifies "No."

    The Security Patch Check tool can verify that a security
    bulletin has been implemented on HP-UX 11.XX systems providing
    that the fix is completely implemented in a patch with no
    manual actions required.  The Security Patch Check tool cannot
    verify fixes implemented via a product upgrade.

    For information on the Security Patch Check tool, see:
    http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
    displayProductInfo.pl?productNumber=B6834AA

    The security patch matrix is also available via anonymous
    ftp:

    ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/

    On the "Support Information Digest Main" page:
    click on the "HP Security Bulletin Archive".

    The PGP key used to sign this bulletin is available from
    several PGP Public Key servers.  The key identification
    information is:

       2D2A7D59
       HP Security Response Team (Security Bulletin signing only)
       <security-alert@xxxxxx>
       Fingerprint =
         6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59

    If you have problems locating the key please write to
    security-alert@xxxxxxx  Please note that this key is
    for signing bulletins only and is not the key returned
    by sending 'get key' to security-alert@xxxxxxx


 D. To report new security vulnerabilities, send email to

    security-alert@xxxxxx

    Please encrypt any exploit information using the
    security-alert PGP key, available from your local key
    server, or by sending a message with a -subject- (not body)
    of 'get key' (no quotes) to security-alert@xxxxxxx

 -----------------------------------------------------------------

(c)Copyright 2003 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical or
editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of HP products referenced
herein are trademarks and/or service marks of Hewlett-Packard
Company.  Other product and company names mentioned herein may be
trademarks and/or service marks of their respective owners.

 ________________________________________________________________



4.  SB-2003.0711 -- HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0310-285
  SSRT3642 Potential Security Vulnerabilities Apache web server on HP-UX
                            VVOS and Webproxy.
                              10 October 2003


Product:                Virtualvault 4.5
                        Virtualvault 4.6
                        Webproxy 2.0
Publisher:              Hewlett-Packard
Operating System:       HP-UX release B.11.04
Platform:               HP9000
Impact:                 Denial of Service
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 -----------------------------------------------------------------
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0310-285
Originally issued: 07 October 2003
SSRT3642 Potential Security Vulnerabilities Apache web server on
         HP-UX VVOS and Webproxy.
 -----------------------------------------------------------------

NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.

The information in the following Security Bulletin should be
acted upon as soon as possible.  Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.

 -----------------------------------------------------------------
PROBLEM: 1. Potential Apache web server crash when it goes into
            an infinite loop due to too many subsequent internal
            redirects and nested subrequests. (VU#379828)

         2. No de-allocation of file descriptors while servicing
            CGI scripts through child processes.

IMPACT:   Potential crash of Apache web server.

PLATFORM: HP9000 Servers running HP-UX release B.11.04 (VVOS)
          with Virtualvault A.04.50 or Virtualvault A.04.60
          installed.

SOLUTION: For Virtualvault and Webproxy releases install
          recommended patches.

           Virtualvault 4.5:
           PHSS_29541  s700_800 11.04 Virtualvault 4.5 IWS Update
           PHSS_29545  s700_800 11.04 Virtualvault 4.5 OWS update

           Virtualvault 4.6:
           PHSS_29542  s700_800 11.04 Virtualvault 4.6 IWS update
           PHSS_29546  s700_800 11.04 Virtualvault 4.6 OWS update

           Webproxy 2.0:
           PHSS_29547  s700_800 11.04 Webproxy server 2.0 update

MANUAL ACTIONS: No

AVAILABILITY: All patches are available now on <itrc.hp.com>.
 -----------------------------------------------------------------
 A. Background
    Virtualvault 4.5, Virtualvault 4.6, Webproxy 2.0: all use
    Apache 1.3.27.

    The Apache Web Server Project
      <http://www.apache.org/dist/httpd/Announcement.html> has
    identified potential vulnerabilities in the Apache HTTP
    Server.


     AFFECTED VERSIONS
     =================
     The following is a list by HP-UX revision of
     affected filesets or patches and fix information.
     To determine if a system has an affected version,
     search the output of "swlist -a revision -l fileset"
     for an affected fileset or patch, then determine if
     a fixed revision or applicable patch is installed.


     The affected filesets are: (product.fileset)

     Virtualvault A.04.50
     VaultTS.VV-IWS,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VVOS-ADM-RUN,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-CORE-CMN,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultWS.WS-CORE,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-JK,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-GUI,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-CORE-CMN,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-JAVA,fr=A.04.50,fa=HP-UX_B.11.04_32/64,v=HP

     Virtualvault A.04.60
     VaultTS.VV-IWS,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP
     VaultWS.WS-CORE,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-CORE-CMN,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-JAVA,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP
     VaultTS.VV-IWS-GUI,fr=A.04.60,fa=HP-UX_B.11.04_32/64,v=HP

 HP Webproxy A.02.00
 HP_Webproxy.HPWEB-PX-CORE,fr=A.02.00,fa=HP-UX_B.11.04_32/64,v=HP

     fix: install
         Virtualvault 4.5: PHSS_29541 PHSS_29545 or subsequent
         Virtualvault 4.6: PHSS_29542 PHSS_29546 or subsequent
         Webproxy 2.0:     PHSS_29547 or subsequent

     END AFFECTED VERSIONS

    The Apache web server version 1.3.28 incorporates fix for the
    following problems:

     1. VU#379828: The server could crash when going into an
        infinite loop due to too many subsequent internal
        redirects and nested subrequests.

     2. No de-allocation of file descriptors while servicing CGI
        scripts through child processes.

    NOTE: This problem does not impact HP NonStop Servers,
          HP OpenVMS, nor the HP Tru64 UNIX/Trucluster Server.


 B. Recommended solution

       Install HP Apache versions 1.3.28

       The fixes for the following Virtualvault and Webproxy
       releases are available with the following patches:

       Virtualvault 4.5:
           PHSS_29541: s700_800 11.04 Virtualvault 4.5 IWS Update
           PHSS_29545: s700_800 11.04 Virtualvault 4.5 OWS update

       Virtualvault 4.6:
           PHSS_29542: s700_800 11.04 Virtualvault 4.6 IWS update
           PHSS_29546: s700_800 11.04 Virtualvault 4.6 OWS update

        Webproxy 2.0:
           PHSS_29547  s700_800 11.04 Webproxy server 2.0 update


 C. To subscribe to automatically receive future NEW HP Security
    Bulletins from the HP IT Resource Center via electronic
    mail, do the following:

    Use your browser to get to the HP IT Resource Center page
    at:

       <http://itrc.hp.com>

    Use the 'Login' tab at the left side of the screen to login
    using your ID and password.  Use your existing login or the
    "Register" button at the left to create a login, in order to
    gain access to many areas of the ITRC.  Remember to save the
    User ID assigned to you, and your password.

    In the left most frame select "Maintenance and Support".

    Under the "Notifications" section (near the bottom of
    the page), select "Support Information Digests".

    To -subscribe- to future HP Security Bulletins or other
    Technical Digests, click the check box (in the left column)
    for the appropriate digest and then click the "Update
    Subscriptions" button at the bottom of the page.

    or

    To -review- bulletins already released, select the link
    (in the middle column) for the appropriate digest.

    NOTE: Using your itrc account security bulletins can be
          found here:
    <http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin>


    To -gain access- to the Security Patch Matrix, select
    the link for "The Security Bulletins Archive".  (near the
    bottom of the page)  Once in the archive the third link is
    to the current Security Patch Matrix. Updated daily, this
    matrix categorizes security patches by platform/OS release,
    and by bulletin topic.  Security Patch Check completely
    automates the process of reviewing the patch matrix for
    11.XX systems.  Please note that installing the patches
    listed in the Security Patch Matrix will completely
    implement a security bulletin _only_ if the MANUAL ACTIONS
    field specifies "No."

    The Security Patch Check tool can verify that a security
    bulletin has been implemented on HP-UX 11.XX systems providing
    that the fix is completely implemented in a patch with no
    manual actions required.  The Security Patch Check tool cannot
    verify fixes implemented via a product upgrade.

    For information on the Security Patch Check tool, see:
    http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
    displayProductInfo.pl?productNumber=B6834AA

    The security patch matrix is also available via anonymous
    ftp:

    ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/

    On the "Support Information Digest Main" page:
    click on the "HP Security Bulletin Archive".

    The PGP key used to sign this bulletin is available from
    several PGP Public Key servers.  The key identification
    information is:

       2D2A7D59
       HP Security Response Team (Security Bulletin signing only)
       <security-alert@xxxxxx>
       Fingerprint =
         6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59

    If you have problems locating the key please write to
    security-alert@xxxxxxx  Please note that this key is
    for signing bulletins only and is not the key returned
    by sending 'get key' to security-alert@xxxxxxx


 D. To report new security vulnerabilities, send email to

    security-alert@xxxxxx

    Please encrypt any exploit information using the
    security-alert PGP key, available from your local key
    server, or by sending a message with a -subject- (not body)
    of 'get key' (no quotes) to security-alert@xxxxxxx

 -----------------------------------------------------------------





 -----------------------------------------------------------------

(c)Copyright 2003 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical or
editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of HP products referenced
herein are trademarks and/or service marks of Hewlett-Packard
Company.  Other product and company names mentioned herein may be
trademarks and/or service marks of their respective owners.




- ----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via EMail to:
uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 20 7821 1330 Ext 4511
Fax: +44 (0) 20 7821 1686

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 20 7821 1330 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Hewlett-Packard for the information
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQCVAwUBP4Z9eYpao72zK539AQHwdQP8CLQwMbbGfiAnIOK9PdQMmY5EumFxon7J
eLQxH+ZZ9SMdVNEXBo3+ifLmb81rHWqOZJTbOT15z7hfTbCpZf8zcL/pLzOn00U/
ozEPXoa8ZBoWjOyzydRGkLC4UmP+z1yYnIaafkKkxdBYyjQB9n5giVNklhDNJ+z5
AIahGIPn+UI=
=7bCP
-----END PGP SIGNATURE-----