How does a Security patch work?

[Shaheen]

I would appreciate to know How really does a Security patch work at the Kernel - Application Level?

How exactly the that particular vulnerability addressed?

[Matti_Kurkela]

A HP-UX security patch removes the file containing the vulnerability and replaces it with a fixed version.

If it's a kernel patch (PHKL_*), it will trigger a kernel recompilation and reboot at the end of the installation. After the reboot, the new kernel no longer has the vulnerable code in it.

As HP-UX source code is not open to the public, only HP employees (and possibly some other people with a NDA and a good reason) can see the actual source code changes that are used to fix a security vulnerability.

The swinstall system will store a backup of the replaced files to /var/adm/sw/save directory hierarchy, in case you want to roll back your patch operation. These old backups can be removed using the "cleanup" command.

MK

[Shaheen]

Thank You, MK.