patch for BLASTER worm

[Ravi_8]

Hi,

Our testing people says, DCE (which uses port 135)was slow in AIX and solaris. and they got a patch from Solaris and IBM. so that DCE uses different port other than 135 and now is working perfectly. is there a similar patch for HP?

thanx in advance

[Zeev Schultz]

PROBLEM: Potential security vulnerability in B.11.11 DCE

IMPACT: Processes may fail.

PLATFORM: HP-UX B.11.11

SOLUTION: Work around by removing patches.

MANUAL ACTIONS: Yes - NonUpdate

AVAILABILITY: This bulletin will be revised when patches are
available.
-----------------------------------------------------------------
A. Background

PHNE_27063 introduced new behavior which can cause DCE
libraries to fail. The behavior is present in the
superseding patches PHNE_28089 and PHNE_28895.

The worm referred to as "Blaster" or "W32.Blaster.worm"
creates network traffic which can lead to the DCE failure when
PHNE_27063, PHNE_28089, or PHNE_28895 is installed..

As the worm attempts to find new systems to infect it can
cause programs to fail. HP-UX is impacted as a side effect
of the network traffic generated by the worm.

The change introduced in PHNE_27063 may have a wide impact,
but at this time the failure has been observed in
/opt/dce/sbin/rpcd and by the sd programs
(swinstall, swlist, etc.).

Note: The affected versions listed below may change when a
fix is available. If the fix is in a DCE library, that
will be listed as the affected software.


AFFECTED VERSIONS

The following is a list by HP-UX revision of
affected filesets or patches and fix information.
To determine if a system has an affected version,
search the output of "swlist -a revision -l fileset"
for an affected fileset or patch, then determine if
a fixed revision or applicable patch is installed.

HP-UX B.11.11
=============
PHNE_27063
PHNE_28089
PHNE_28895
fix: work around the problem by removing the patches

END AFFECTED VERSIONS


B. Recommended solution

Until a fix is available the problem can be avoided by
removing PHNE_27063, PHNE_28089, and PHNE_28895. This
should be done with caution. Be sure to create a backup
before attempting to remove these patches.

[Zeev Schultz · Accepted solution]

Sorry,there is an updated ones here :
http://www5.itrc.hp.com/service/cki/secBullArchive.do

search on DCE.

For example http://www5.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0308-274
speaks on OVO patches.

[Ravi_8]

Hi zeev

Thanx a ton, your reply helped me a lot to silence my people over here