tftp patch & reboot

[Mark Greene_1]

The HP security bulletin sent on 6/19 announced a vulnerability in tftpd, and a patch for it.

The text file that gets downloaded with the depot says that there is no automatic reboot. However, the swinstall instructions indicate that this will if it needs to:


5. Run swinstall to install the patch:

swinstall -x autoreboot=true -x patch_match_target=true -s /tmp/PHNE_29129.depot


Are these swinstall options simply the defaults used by HP for all their patches, or is there a conflict in what this implies regarding a reboot? I am running tftpd on one of my HP servers to provide configuration servers for some of our Terminal Servers and Routers, so I need this patch. However, I cannot indescriminately reboot the system.

Has anyone else installed this yet, and if so, did your system reboot?

TIA,
mark

[Sridhar Bhaskarla]

Hi Mark,

For non-interactive swinstalls, HP defaults to this option. Even for a simple commands patch, you will find the command with -x auto_reboot=true.

Though I didn't install the patch, I don't believe this needs a reboot.

To make it sure, use interactive session. Point the depot to local system /tmp/PHNE_29129.depot. After analasys and when you press install, it will give you a warning that it is going to reboot the box. You can cancel installation at that time.

-Sri

[James R. Ferguson · Accepted solution]

Hi Mark:

The '-x autoreboot=true' option ot 'swinstall' simply instructs 'swinstall' to issue a reboot if one is required. The patch's fileset contains an attriubte that signals the need for a reboot or not.

You can verify a patch's reboot requirement with:

# swlist -d -l fileset -a is_reboot *.*,c=patch @ /tmp/depot | grep true

The above exampel assumes the patch(s) reside in a depot '/tmp/depot'.

Regards!

...JRF...

[A. Clay Stephenson]

That's simply the default swinstall instructions for all HPUX patches. If the patch release notes indicate that no reboot is needed then the flag will do no harm and the system will not automatically reboot. The is the normal setting. If a patch requires a reboot AND you do not want the system to reboot automatically at the end of the swinstall THEN you set autoreboot=false though you must then reboot manually later.

[Steven E. Protter]

Best guess is:

HP either made a mistake in the documentation or a mistake when they built the depot.

Either way, if the patch is needed, you'd best schedule it for a maintenance window and be done with it.

It would be nice to know.

I've had patches require the -x autoreboot=true and then not bother to boot the system.

Nobody's perfect.

Not even HP

SEP

[Mark Greene_1]

I used the verification process provided by James, and the patch does not require a reboot. So, tomorrow I can run an ignite backup and install the patch. I will do in install interactively; I am much more at ease watching what is going on than not!

My thanks to all who replied.

mark