INFORMATION BULLETIN

F-02: Summary of HP Security Bulletins

November 17, 1994 1300 PST


PROBLEM:        Security vulnerabilities in all versions of HP UX.
PLATFORM:       All Hewlett Packard systems.
DAMAGE:         Unauthorized access to system and files, denial of service.
SOLUTION:       Apply appropriate security patches.

VULNERABILITY   Many of these vulnerabilities are widely known and used to
ASSESSMENT:     compromise systems.  CIAC urges affected sites to install the
                appropriate patches immediately.

Critical Information about HP Security Bulletins

CIAC has compiled a summary of all security related patches currently available from Hewlett Packard. The patches are presented first in a table format, then a summary of the vulnerability information is presented for each patch in the order in which the HP Bulletins were distributed.

HP has set up an automatic server to allow patches and other security information to be retrieved over the Internet. To utilize this server, send a message to support@support.mayfield.hp.com. The subject line of the message will be ignored. The body (text) of the message should contain the words

   send XXXX

where XXXX is the identifier for the information you want retrieved. For example, to retrieve the patch PHSS_4834, the message would be "send PHSS_4834".

Other information that can be retrieved include the HP SupportLine mail service user's guide (send guide.txt), the readme file for a patch (send doc PHSS_4834), and the original HP bulletin (send doc HPSBUX9410-018).

HP also has a World Wide Web server to browse and retrieve bulletins and patches. To utilize this server, use a WWW client and connect to http://support.mayfield.hp.com.

IMPORTANT NOTE: Hewlett Packard updates patches periodically. These updates are not reflected in the text of each HP bulletin. The overview presented here contains current information on the patches available at the time of the release of this CIAC bulletin. If you request an updated patch, when you try to retrieve the patch you will receive a message stating that the patch is obsolete and the name of the patch which supersedes it.

Hewlett Packard has made sum and MD5 checksums available for their patches and for their security bulletins. See the detailed explanation for HPSBUX9408-016 for information on how to access and utilize these checksums.

CIAC wishes to thank Hewlett Packard for helping CIAC construct this summary.

CIAC services are available to DOE, DOE Contractors, and the NIH. CIAC can be contacted at:

    Voice:          +1 925-422-8193 (7 x 24)
    FAX:            +1 925-423-8002
    STU-III:        +1 925-423-2604
    E-mail:          ciac@ciac.org
    World Wide Web:  http://www.ciac.org/
    Anonymous FTP:   ftp.ciac.org

This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes.

UCRL-MI-119788
[Privacy and Legal Notice]