topic Re: secunia reported HP-UX patches that were not highlighted when using swainv in Operating System - HP-UX

secunia reported HP-UX patches that were not highlighted when using swainv

Fenglin — Mon, 09 Jun 2008 07:18:58 GMT

Secunia reported HP-UX patches that were not highlighted after running swainv on that particular server. Do I patch those that were mentioned by secunia?

Secunia is meant to scan for vulnerabilities and missing security patches.

The following were mentioned by secunia.
1)HP-UX ARPA Transport Unspecified Denial of Service Vulnerability
2)HP-UX ftp Server Unspecified Denial of Service
3)HP-UX HP CIFS Server Multiple Vulnerabilities
4)HP-UX LDAP-UX Privilege Escalation Vulnerability
5)HP-UX Secure Shell Unauthorized Access Vulnerability
6)HP-UX update for Apache
7)HP-UX update for Apache with PHP
8)HP-UX update for Netscape Directory Server
9)HP-UX useradd Security Bypass
10)HP-UX WBEM Services OpenPegasus PAM Module Buffer Overflows

Please reply asap. Many thanks.

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Ivan Krastev — Mon, 09 Jun 2008 07:34:08 GMT

I don't know how secunia works, but swainv generationg report from installed patches/products and after that you can use it in ITRC to obtain list of required patches.
This list doesn't contain by default the patches for products - such as Apache, Netscape DS and so on ...

If you have it installed you can use this patches as well.

regards,
ivan

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Fenglin — Mon, 09 Jun 2008 07:48:38 GMT

How critical is it to install the patches for the above? Is there really a need to do so?

Thank you for your prompt reply in advance.

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Mustafa Gulercan — Mon, 09 Jun 2008 07:48:47 GMT

hi;
you can also use Software Assistant (SWA)that consolidates and simplifies patch management and security bulletin management on HP-UX systems. SWA can perform a number of checks including published security issues, installed patches with warnings, and missing patches with critical fixes.
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6834AA

regards,
mustafa

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Fenglin — Mon, 09 Jun 2008 09:28:04 GMT

Hi mustafa

Am i correct to say that after running swa, if the output show me that there is a need to fix the security patches mentioned, then i go ahead to install them? Otherwise, I don't proceed to install them.

What are the recommendations?

Thanks in advance.

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Mustafa Gulercan — Mon, 09 Jun 2008 10:08:21 GMT

hi,
if the systems are after a firewall or in a DMZ network (i mean that if they are all in a secure and private network) may be you don't need.
But i recommend that you should upgrade your software and do the critical patches.

regards,
mustafa

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Bob E Campbell — Tue, 10 Jun 2008 21:06:41 GMT

OK, using swainv directly with the ITRC will tell you only about patches. Try using the Software Assistant tool available from https://www.hp.com/go/swa. The command:

# swa report -a SEC

will list all of the required patches as well as the product updates and related manual actions to resolve the bulletins.

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Fenglin — Wed, 11 Jun 2008 04:41:54 GMT

I find that patch,PHNE_36193 can rectify 2) and PHCO_37291 can rectify 9)

Can someone tell me where to download the patches? I have been trying to search for them but cannot find...

Don't direct me to the SWA website. From there, I am not sure where to download it either.

So kindly give me detailed instructions. Many Thanks.

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Dennis Handly — Wed, 11 Jun 2008 04:56:53 GMT

>Can someone tell me where to download the patches?

At the bottom of the HP-UX forum page is a link to HP-UX Patch Database.
http://www.itrc.hp.com/service/patch/mainPage.do

Searching from there will get you to:
http://www.itrc.hp.com/service/patch/patchDetail.do?patchid=PHNE_36193&sel={hpux:11.23,}&BC=main|search|
http://www.itrc.hp.com/service/patch/patchDetail.do?patchid=PHCO_37291&sel={hpux:11.23,}&BC=main|search|

Just put both in your shopping cart and download them.

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Fenglin — Wed, 11 Jun 2008 06:28:20 GMT

what is the difference between HP-UX B.11.23 (11i v2)and HP-UX B.11.23 (11i v2)upgrade to A.05.00.013? Is there a way to download the version to A..05.00.013? and where to download it?

Many thanks.

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Dennis Handly — Wed, 11 Jun 2008 07:45:10 GMT

>what is the difference between HP-UX B.11.23 and HP-UX B.11.23 upgrade to A.05.00.013? Is there a way to download the version to A.05.00.013?

You might want to mention what you are asking about now? Is this swainv or one of the above patches you were just asking about?

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Fenglin — Wed, 11 Jun 2008 09:31:05 GMT

Hi

The reason I ask the previous question was because it was supposed to solve 6). I am interested in understanding that small difference in the version and where to download that upgraded version?

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Fenglin — Thu, 12 Jun 2008 05:45:42 GMT

Hi Dennis,

I downloaded PHNE_36193 like the way you guided me. It was downloaded with a lot of other patch dependencies in a tar file.

After extracting the tar file, I tried to install those dependencies patches. But they are giving me I/O errors.

Any idea what is wrong?

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Dennis Handly — Thu, 12 Jun 2008 07:38:23 GMT

>The following were mentioned by secunia.

Not all of these have HP-UX patches yet.
You can subscribe to Security Bulletins and get ftp sites with a patch:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC

In particular the newsgroups comp.sys.hp.hpux, comp.security.unix, comp.security.misc get these notices.

There I noticed one for Apache:
HPSBUX02342 SSRT080063 rev.1 - HP-UX Running Apache or Tomcat with PHP, Remote Execution of Arbitrary Code

You can get other bulletins from:
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Dennis Handly — Thu, 12 Jun 2008 07:45:27 GMT

>I downloaded PHNE_36193 like the way you guided me. It was downloaded with a lot of other patch dependencies in a tar file.

Here is what I got for something similar:
hpux__11.23_08301210.tgz

>After extracting the tar file, I tried to install those dependencies patches. But they are giving me I/O errors.

After you extract the files you should get:
PH??_????? ...
README_hp-ux
create_depot_hp-ux_11*
patch_manifest

It's all explained in the README.
1) Invoke:
# create_depot_hp-ux_11
2) swinstall:
# swinstall -s $PWD/depot \*

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Fenglin — Thu, 12 Jun 2008 08:30:32 GMT

Thanks.

When i try to 'swinstall -s path/depot', it complains that there is no depot software in there. But actually,there is already a directory,depot there which includes all the patches needed.

How to solve this last issue?

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Dennis Handly — Thu, 12 Jun 2008 08:44:00 GMT

>When i try to 'swinstall -s path/depot'

You need an absolute path, better to use $PWD.

>it complains that there is no depot software in there. But actually,there is already a directory, depot there which includes all the patches needed.

Does swlist show it?
# swlist -s $PWD/depot

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Anshumali — Thu, 12 Jun 2008 09:44:23 GMT

did you miss \*?

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Fenglin — Fri, 13 Jun 2008 04:26:45 GMT

After typing 'swinstall -s $PWD/depot \*', this is what I got below.

BUNDLE B.2008.06.12 Patch Bundle.

I did a 'swlist|more'. I dont see the patches installed.

Any idea? Thanks

Re: secunia reported HP-UX patches that were not highlighted when using swainv

Dennis Handly — Fri, 13 Jun 2008 05:10:13 GMT

>this is what I got below: BUNDLE B.2008.06.12 Patch Bundle.
>I did a swlist. I don't see the patches installed.

(You were helped by create_depot_hp-ux_11, right over that cliff. :-)

You need to use the following to see the details:
# swlist -l patch