Patching HP Security Bulletin 175 - dtspcd

[joeone]

Hello,

I'm trying to harden an HP-UX 10.20 system to withstand security scans. The network security folks tell me that I need to patch the CDE Subprocess Control daemon, and this vulnerability corresponds to HP Security Bulletin 175.

So I use the HP software patch website and download the "recommended patch", PHSS_29201 (s700_800 10.20 CDE Runtime Patch), which is described as an updated version of the patch listed in the bulletin. It also has two dependencies which I added to the software depot. I used swinstall to put the depot on the system. The system said that all 8 packages were installed correctly.

My only problem is that even though I believe the system is patched, the security people say their scanner still finds the vulnerability. At this point I'm stumped, because I've already tried removing and reinstalling the patches and the scan result remains the same. Anyone have any pointers on this?

Joe

[Patrick Wallek · Accepted solution]

Do you need dtspcd? If you don't need it, then comment it out in /etc/inetd.conf and then stop and restart inetd.

This should definitely fix the problem.

[Steven E. Protter]

Shalom Joe,

You should not harden the 10.20 system, you should look into replacing it with a hardened system.

The OS out of support some three years this July and the tools to harden newer releases are much more extensive.

I'd have to see the data from the scanners and no what tool they are using to further assist. they could be wrong.

You can close the vulnerability by not using the daemon at all. Bastille commonly offers to disable this on newer OS's.

SEP

[joeone]

Thanks for the tip... for some reason, the security bulletin didn't explicitly say to stop the service. But I think that stopping it solves the problem better than installing the patch...