topic Re: Patching HP Security Bulletin 175 - dtspcd in Operating System - HP-UX

Patching HP Security Bulletin 175 - dtspcd

joeone — Thu, 30 Mar 2006 12:29:09 GMT

Hello,

I'm trying to harden an HP-UX 10.20 system to withstand security scans. The network security folks tell me that I need to patch the CDE Subprocess Control daemon, and this vulnerability corresponds to HP Security Bulletin 175.

So I use the HP software patch website and download the "recommended patch", PHSS_29201 (s700_800 10.20 CDE Runtime Patch), which is described as an updated version of the patch listed in the bulletin. It also has two dependencies which I added to the software depot. I used swinstall to put the depot on the system. The system said that all 8 packages were installed correctly.

My only problem is that even though I believe the system is patched, the security people say their scanner still finds the vulnerability. At this point I'm stumped, because I've already tried removing and reinstalling the patches and the scan result remains the same. Anyone have any pointers on this?

Joe

Re: Patching HP Security Bulletin 175 - dtspcd

Patrick Wallek — Thu, 30 Mar 2006 12:33:14 GMT

Do you need dtspcd? If you don't need it, then comment it out in /etc/inetd.conf and then stop and restart inetd.

This should definitely fix the problem.

Re: Patching HP Security Bulletin 175 - dtspcd

Steven E. Protter — Thu, 30 Mar 2006 13:16:52 GMT

Shalom Joe,

You should not harden the 10.20 system, you should look into replacing it with a hardened system.

The OS out of support some three years this July and the tools to harden newer releases are much more extensive.

I'd have to see the data from the scanners and no what tool they are using to further assist. they could be wrong.

You can close the vulnerability by not using the daemon at all. Bastille commonly offers to disable this on newer OS's.

SEP

Re: Patching HP Security Bulletin 175 - dtspcd

joeone — Fri, 07 Apr 2006 16:38:46 GMT

Thanks for the tip... for some reason, the security bulletin didn't explicitly say to stop the service. But I think that stopping it solves the problem better than installing the patch...