topic Re: FTP "|" Vulnerability in Operating System - HP-UX

FTP "|" Vulnerability

Robin King_1 — Tue, 04 Feb 2003 09:20:46 GMT

I have been asked to investigate the reported vulnerability with ftp and "|" when used in the filename.

http://online.securityfocus.com/bid/396/discussion/

I can't seem to find a relevant patch in the database, can anyone advise the patches I should be looking for. I need to patch 10.20 and 11.0

Thanks!

Re: FTP "|" Vulnerability

Bill McNAMARA_1 — Tue, 04 Feb 2003 09:31:04 GMT

enter ftp in at this link:
http://www4.itrc.hp.com/service/cki/enterService.do?category=c1s9

Although I believe that issue is as old as the hills, I think with a recent QPK you'll be just fine.

Later,
Bill

Re: FTP "|" Vulnerability

U.SivaKumar_2 — Tue, 04 Feb 2003 09:31:21 GMT

Hi,

These patches will fix that.( check for any superseded patches if any )

HP-UX release 10.20 PHNE_13597
HP-UX release 10.20 PHNE_15544
HP-UX release 11.00 PHNE_14479

you can get this patches from this site itself.

regards,

U.SivaKumar

Re: FTP "|" Vulnerability

Robin King_1 — Tue, 04 Feb 2003 09:33:00 GMT

Thanks both of you, just found this on the Security Focus website.

Install the applicable patches for the fileset: InternetSrvcs.INETSVCS-RUN or InternetSrvcs.INET-ENG-A-MAN.

HP-UX release 10.0,10.01,10.10 PHNE_13596
HP-UX release 10.16 PHNE_16006
HP-UX release 10.20 PHNE_13597
HP-UX release 10.24 PHNE_15802
HP-UX release 11.00 PHNE_14479

Re: FTP "|" Vulnerability

Mark Greene_1 — Tue, 04 Feb 2003 14:44:09 GMT

Be aware that patch PHNE_14479 has been superceded by PHNE_23949.

mark