The Harris STAT scanning tool and the 11.00 Support Tool Manager Sep 2002 Patch

[Erik Rabe]

When performing a vulnerability scan of HP-UX 11.0, the Harris STAT tool finds:

(H0016)- A flaw in the system socket I/O functionality in HP-UX has been discovered. This flaw can be exploited to cause denial of service conditions in certain applications. HP mentioned diagmond as an example. Remote and local users could induce this type of failure.

Recommended solution

Install PHNE_27886 and PHSS_28617

When the administrator attempts to load PHSS_28617, all three filesets are rejected.

NOTE: The patch fileset "PHSS_28617.STM-CATALOGS,r=1.0" may only be
installed upon a previously installed base fileset. The
specification for this base fileset is
"Sup-Tool-Mgr.STM-CATALOGS,fr=B.11.00.22.12,v=HP". Since
there is no fileset on the target or selected from the source
which matches this specification, fileset
"PHSS_28617.STM-CATALOGS,r=1.0" will be excluded.

NOTE: The patch fileset "PHSS_28617.STM-SHLIBS,r=1.0" may only be
installed upon a previously installed base fileset. The
specification for this base fileset is
"Sup-Tool-Mgr.STM-SHLIBS,fr=B.11.00.22.12,v=HP". Since there
is no fileset on the target or selected from the source which
matches this specification, fileset
"PHSS_28617.STM-SHLIBS,r=1.0" will be excluded.

NOTE: The patch fileset "PHSS_28617.STM-UUT-RUN,r=1.0" may only be
installed upon a previously installed base fileset. The
specification for this base fileset is
"Sup-Tool-Mgr.STM-UUT-RUN,fr=B.11.00.22.12,v=HP". Since there
is no fileset on the target or selected from the source which
matches this specification, fileset
"PHSS_28617.STM-UUT-RUN,r=1.0" will be excluded.

How can the vulnerabilty identified be addressed if the patch can't be loaded.

(Harris has been notified of this problem as well)

[Cheryl Griffin]

The swinstall message references that the patches are required for Sup-Tool-Mgr.STM-CATALOGS,fr=B.11.00.22.12


Looking at the matrix on http://www.docs.hp.com/hpux/onlinedocs/diag/stm/stm_upd.htm#table

B.11.00.22.12 indicates that this is STM version A.34.00 HWE 0209 Sept 02 (B.11.00.22.xx)


Check to see what version you have installed.
# swlist -l product |egrep -e "diag|STM|Sup-Tool" |more

If you do not have this exact version, then the patches do not apply to your system for this issue.

[Erik Rabe]

The Folks at Harris concur. First the scanning tool must test to see if diagmond is loaded, and (only) if it is, the tool should then test for PHSS_28617 to be installed...

--Thanx!