INFORMATION BULLETIN
INFORMATION BULLETIN
PROBLEM: Security vulnerabilities in the `at' and `cron' commands can be used by users to gain unauthorized access privileges. PLATFORMS: HP 9000 series 300/400 and/or 700/800s, for HP-UX versions 8.x and 9.x. DAMAGE: Users can gain unauthorized privileges. SOLUTION: Apply appropriate vendor patch as described below.
VULNERABILITY The security vulnerability in HP-UX `at' and `cron' commands ASSESSMENT: can be used by local users to gain unauthorized access privileges which may result in system compromise. CIAC urges affected sites to install the appropriate patch as soon as possible.
The document ftp://ciac.llnl.gov/pub/ciac/bulletin/f-fy95/hppatchs.txt has been updated to reflect this bulletin. The hppatchs.txt document contains the entire list of all HP Bulletins and patches.
IMPORTANT NOTE: Hewlett Packard updates patches periodically. These updates are not reflected in the text of each HP bulletin. The overview presented here contains current information on the patches available at the time of the release of this CIAC bulletin. If you request an updated patch, when you try to retrieve the patch you will receive a message stating that the patch is obsolete and the name of the patch which supersedes it.
Hewlett Packard has made sum and MD5 checksums available for their patches and for their security bulletins. See the detailed explanation for HPSBUX9408-016 in CIAC bulletin F-02 for information on how to access and utilize these checksums.
Following is the copy of the HP bulletin (HPSBUX9502-023):
[Begin HP Bulletin]
-------------------------------------------------------------------------------
Summary of 'Daily Security Bulletins Digest' documents
-------------------------------------------------------------------------------
Document Id Description Page 1
-------------------------------------------------------------------------------
HPSBUX9502-023 Security vulnerability in `at' & `cron'
===============================================================================
Detailed list of 'Daily Security Bulletins Digest' documents
===============================================================================
Document Id: [HPSBUX9502-023]
Date Loaded: [02-22-95]
Description: Security vulnerability in `at' & `cron'
===============================================================================
-------------------------------------------------------------------------
HEWLETT-PACKARD SECURITY BULLETIN: #00023, 22 Feb 95
-------------------------------------------------------------------------
The information in the following Security Bulletin should be acted upon as
soon as possible. Hewlett- Packard will not be liable for any consequences
to any customer resulting from customer's failure to fully implement
instructions in this Security Bulletin as soon as possible.
PROBLEM: Security vulnerability in the `at' and `cron' command in HP-UX
PLATFORM: HP 9000 series 300/400s and/or 700/800s
DAMAGE: Users can gain unauthorized privileges
SOLUTION: Apply patch PHCO_5203 (series 700 , HP-UX 8.X), or
PHCO_5204 (series 800 , HP-UX 8.X), or
PHCO_5199 (series 300/400, HP-UX 8.X), or
PHCO_5178 (series 700 , HP-UX 9.X), or
PHCO_5193 (series 800 , HP-UX 9.X), or
PHCO_5206 (series 300/400, HP-UX 9.0), or
PHCO_5206 (series 300/400, HP-UX 9.03).
AVAILABILITY: All patches are available now.
I. Update
A. It has been found that all HP-UX systems have this vulnerability.
B. Fixing the problem
The vulnerability can be eliminated from releases 8.X and 9.X of
HP-UX by applying a patch.
All customers concerned with the security of their HP-UX systems
should apply the appropriate patch described above as soon as possible.
C. How to Install the Patch (for HP-UX 8.X and 9.X)
1. Determine which patch is appropriate for your hardware platform and
operating system:
PHCO_5203 (series 700 , HP-UX 8.X), or
PHCO_5204 (series 800 , HP-UX 8.X), or
PHCO_5199 (series 300/400, HP-UX 8.X), or
PHCO_5178 (series 700 , HP-UX 9.X), or
PHCO_5193 (series 800 , HP-UX 9.X), or
PHCO_5206 (series 300/400, HP-UX 9.0), or
PHCO_5206 (series 300/400, HP-UX 9.03).
2. Hewlett Packard's HP-UX patches are available via email & WWW
(MOSAIC).
To obtain a copy of the HP SupportLine email service user's guide,
send the following in the TEXT PORTION OF THE MESSAGE to
support@support.mayfield.hp.com (no Subject is required):
send guide
The users guide explains the process for downloading HP-UX patches
via email and other services available.
WWW (MOSAIC) service (downloading of patches) is
also available via WWW (MOSAIC) our URL is:
(http://support.mayfield.hp.com)
3. Apply the patch to your HP-UX system.
4. Examine /tmp/update.log for any relevant WARNINGs or ERRORs. This
can be done as follows:
a. At the shell prompt, type "tail -60 /tmp/update.log | more"
b. Page through the next three screens via the space bar, looking
for WARNING or ERROR messages.
D. Impact of the patch and workaround
The patch for HP-UX releases 8.X and 9.X provides a new version of
/etc/cron and /usr/bin/at which fixes the vulnerability.
E. To subscribe to automatically receive future NEW HP Security Bulletins
from the HP SupportLine mail service via electronic mail,
send an email message to:
support@support.mayfield.hp.com (no Subject is required)
Multiple instructions are allowed in the TEXT PORTION OF THE MESSAGE,
here are some basic instructions you may want to use:
* To add your name to the subscription list for new security
bulletins, send the following in the TEXT PORTION OF THE MESSAGE:
subscribe security_info
* To retrieve the index of all HP Security Bulletins issued to date,
send the following in the TEXT PORTION OF THE MESSAGE:
send security_info_list
WWW (MOSAIC) service (Browsing of Bulletins) is also available via
WWW. Our URL is:
(http://support.mayfield.hp.com)
Choose "Support news", then under Support news,
choose "Security Bulletins"
F. To report new security vulnerabilities, send email to
security-alert@hp.com
[End HP Bulletin]
Voice: +1 925-422-8193 (7 x 24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org