topic Re: Security issue in Operating System - HP-UX

Security issue

Kenn Chen — Mon, 08 Oct 2001 04:25:06 GMT

Currently, we found that omniback having some weakness to let some hacks application to logon into my HP-UX server. We have proved that could someone having this kind of problem before ? If yes, what is the solution. I heard that need some omniback patches. What pathches ? Thanks in advance.

Re: Security issue

Michael Tully — Mon, 08 Oct 2001 04:46:06 GMT

Hi,

I've not heard of any OmniBack related
security problems before.
Follow this link and sign up to receive
the HP security bulletins. You can also
look up some of the older bulletins that
would have been sent out.

http://us-support.external.hp.com/digest/bin/doc.pl/sid=48d96b4d0bb6221da4/screen=digestSubscr

HTH
-Michael

PS The OmniBack patch list I gave you before is
the patch list. If there happen to be any
security related patches that's where you
would find them.

Re: Security issue

Animesh Chakraborty — Mon, 08 Oct 2001 04:50:57 GMT

Hi ,
I know about this security issue---
Lately, there is a security vulnerability in 'rlpdaemons' (remote printing
daemons) as follow:

===================================================
HP-UX is shipped with a line printer daemon adapted from BSD UNIX.
Many commercial and open-source operating systems are adapted from
BSD UNIX. The HP line printer daemon is similar to "in.lpd" in other UNIX
variants. The Line Printer Daemon is used to allow heterogeneous UNIX
environments to share printers over a network.

A buffer overflow exists in rlpdaemon that may allow remote attackers
to send a specially-crafted print request to crash the service, or execute
arbitrary code with superuser privilege on the target system. The
vulnerability is particularly serious because rlpdaemon is installed
and configured by default and is active even if it is not being used.
No local account or knowledge of the configuration on the target system
is needed to successfully exploit this vulnerability.

The following versions are known to be vulnerable:

HP-UX 10.01, 10.10
HP-UX 11.00, 11.11

Solution

All administrators who have not implemented network printing should
immediately disable rlpdaemon, as well as any other unused services.
The following patches should be immediately applied to address the
vulnerability:

10.01 PHCO_24697
10.10 PHCO_24698
10.20 PHCO_24699
11.00 PHCO_24700
11.11 PHCO_24701

This may not be reply of your question..still I wanted to share with you.
regards
Animesh

Re: Security issue

Dylan Fahey — Thu, 15 Nov 2001 15:29:26 GMT

And this is another reason I'm so frustrated with the patching scheme for HP-UX. I went to the patch database and couldn't find the patches for this problem. Where is it?
Why is so hard to find particular patches? Why do you have to be a darn Rocket Scientist to figure out what patches to load?