topic Re: HP TCPIP vulnerable? in Operating System - OpenVMS

HP TCPIP vulnerable?

Peter Zeiszler — Mon, 22 Dec 2014 18:22:59 GMT

With the recent notice concerning NTP is HP TCPIP on OpenVMS vulnerable and if it is, will the be a patch?

https://ics-cert.us-cert.gov/advisories/ICSA-14-353-01

Re: HP TCPIP vulnerable?

Hoff — Mon, 22 Dec 2014 20:02:38 GMT

The version number of the VMS NTP server is — if it's actually the ISC version — ancient.

I'd expect that the NTP server is vulnerable, and that it's likely best to ask HP support directly, respectively.

In my opinion, it's usually best to firewall VMS acccess. VMS configurations commonly feature various other insecure transports. There's usually little reason to expose a VMS-based NTP server outside of the local network. There's no secure POP or IMAP support with TCP/IP Services, and SCS is wide open to anyone with a privileged network position, SMB/CIFS was pretty old, Apache is old and contains a known-insecure SSL implementation, etc.

Re: HP TCPIP vulnerable?

Peter Zeiszler — Mon, 22 Dec 2014 21:23:18 GMT

Luckily we are behind firewalls and such. Just wondering if I needed to find a new patch to upload to systems and if anyone else had heard anything about it. Today's alerts was the first I heard about it. I know about the older protocols and apache.