topic Re: security_patch_check in Operating System - HP-UX

security_patch_check

Schelstraete Bart_1 — Thu, 25 Apr 2002 06:27:01 GMT

Hello,

A few months ago we installed Sendmail-8.11.1 on one of our HP-UX 11.0 machines....
If we're runnging security_patch_check now, he says that there is a patch available for sendmail 8.9.3 (PHNE_24419)

Is it normal that security_patch_check says to install this patch while we don't have that specific package (version)?

Re: security_patch_check

Niraj Kumar Verma — Thu, 25 Apr 2002 06:44:27 GMT

Can you check wheather you have this version of snedmail or patch

# swlist -l product |grep sendmail

-Niraj

Re: security_patch_check

Richard Woolley — Thu, 25 Apr 2002 06:45:50 GMT

Im not sure why its done that but there is a document explaining a little more about the situation. A security vulnerability..

http://europe-support2.external.hp.com/cki/bin/doc.pl/sid=70081d5902eaf4af39/screen=ckiDisplayDocument?docId=200000060152540

Re: security_patch_check

Schelstraete Bart_1 — Thu, 25 Apr 2002 06:56:19 GMT

Hello,

This is the output:
#> swlist -l product |grep sendmail
PHNE_17190 sendmail(1m) 8.8.6 patch
PHNE_18546 sendmail(1m) 8.9.3 patch
SMAIL-811 sendmail(1m) 811 special release upgrade

(as you can see, the old 89.3 was updated to 8.11)

rgrds,

Bart

Re: security_patch_check

Niraj Kumar Verma — Thu, 25 Apr 2002 07:00:01 GMT

Hi,

the Info is right , you are getting this message becaue you have an old patch PHNE_18546 installed on you system which have been upgraded to PHNE_24419.

I feel the message should disapper if you uninstall PHNE_18546 patch.

-Niraj

Re: security_patch_check

Victor_5 — Thu, 25 Apr 2002 12:44:50 GMT

PHNE_24419 is sendmail patch for 11.00, for 11.11, it is PHNE_25184.

This affects sendmail 8.8.6 on HP-UX 10.20 and 11.00, sendmail 8.9.3 on HP-UX 10.20, 10.24, 11.00, 11.04 and 11.11.

In HP sendmail release 8.8.6 and 8.9.3 under certain conditions an email queue warning message is returned with the Diagnostic-Code and incorrect information not intended to be seeen without authorization. However, HP sendmail release 8.11.1 does not exhibit this problem.

In your case, I don't think you need to install this patch.