Security Patch Check output

[Sean OB_1]

Howdy,

I see that SPC has changed the output. Can someone help me in finding out more info on what it now reports?

EX:

# Recommended Bull Cnt Spec Reboot PDep Description
--------------------------------------------------------------------------------
1 Ignite-UX 111r2 1st man ? ? check /etc/passwd on trusted systems ignited from old images


For this I went to the security bulletin page listed at the bottom of the patch check. I then searched for 111r2 and got no results. What's the easiest way to find out more information on what SPC now reports?

[Steven E. Protter]

The product would appear to be reporting a possible security problem if you ignite a trusted system from older images.

I can't figure out whether this means prior tot he conversion to trusted or in any event.

I would check such systems with pwck and grpck at the very least and make sure passwords for a few users you know work right and are not nulled out.

I an find nothing on this in HP's web sites.

SEP

[Gordon Morrison]

I think this is the bulletin SPC is referring to. I agree that the output isn't very clear and takes a bit of perseverance and guesswork to find the relevant bulletin.

http://www5.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0002-111

[Sean OB_1]

I guess my question was more in general, on how do you find the right bulletin for what is listed in the SPC results.

Searching for the bulletin as listed in SPC brings back no results for anything I've tried.

I really don't have time to read through 200 bulletins looking for the right one.

HP, if you are reading this, please make it easier to find the info you list in SPC.

Thanks!

[Gordon Morrison]

As I said, it's not very clear. This is the way I find bulletins (it's a bit of a performance):
SPC specifies bulletin 111. This is not the complete bulletin reference number, but the complete number will end in 111. Go to the Security Bulletin website, and in Internet Explorer, click "Edit" --> "Find (on this page)" then enter 111 in the "find what" box, then click "Find next".
Keep clicking "Find next" until you come to something that looks vaguely like the description from SPC. If it says anything like "rev. 2" in there, it's a bonus, but don't count on it.

HP, I would like to second Sean's request for increased clarity and ease of use.

[Jeff Lightner_1]

I recently went through the Security Patch Check stuff and found the following worked well for me:

1) Use Mozilla Firefox as your browser.

2) Open a tab for the HP Security Bulletin Archive at:
http://www1.itrc.hp.com/service/cki/secBullArchive.do?admit=-682735245+1110292197471+28353475

This tab will contain the bulletin numbers you are seeing in the "Bull" column of your output but does not show them in the same format. Instead you'll see a column which has the rev# which is equivalent to the r# you see in output. Also the first part of the number you have in your output is the end of a longer number in the next column of this tab. You should do a search for the number adding a space to the end of it.

The bulleting will be followed either by a description or an SSRT number. In Firefox you can open the link in a new tab (thereby preserving this tab as you'll need it many times and it sometimes is slow to load). Items not followed by an SSRT are usually informational and don't specify patches but rather actions to be taken.

3) Open a second tab for the HP Security Patch matrix at:
http://www1.itrc.hp.com/service/cki/docDisplay.do?admit=-682735245+1110292229244+28353475&docId=hpuxSecurityMatrix

You can look up the SSRT numbers found from the first tab in this second tab. (Here again preserve this tab as you'll need it multiple times.)

Example:
Security Patch Check output line:
# Recommended Bull Cnt Spec Reboot PDep Description
--------------------------------------------------------------------------------
1 Ignite-UX 111r2 1st man ? ? check /etc/passwd on trusted sy
stems ignited from old images

We need to find 111r2 as it is in the "Bull" column.

In first tab search for "111 " and you'll see:
2005 Jan 26 rev.0 HPSBUX01111 SSRT5900 rev.0 HP-UX TGA daemon remote Denial of Service (DoS)
Since it is rev 0 it is NOT the one we want.

Search next and we find:
2004 Dec 01 rev.2 HPSBUX0002-111 SSRT4878 rev.2 Ignite-UX failed to save /etc/passwd for trusted systems
Sice it is rev 2 it IS the one we want (111r2).

In the second tab do a search for SSRT4878.

The above is fairly cumbersome but was the best approach I found.

By the way items without an r number in your output are equivalent to rev.0.

[Keith Buck · Accepted solution]

See this thread:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=854460

I have posted a sed script which will give you direct links to the bulletins. We are also taking this feedback and incorporating improved reporting mechanisms into the next release.

Thanks

-Keith