===============================================================================
o HP Electronic Support Center World Wide Web Service
---------------------------------------------------
If you subscribed through the HP Electronic Support Center and would
like to be REMOVED from this mailing list, access the
HP Electronic Support Center on the World Wide Web at:
http://us-support.external.hp.com
Enter the Support Information Digests service as a registered user,
using your HP Electronic Support Center User ID and Password to login.
You may then unsubscribe from the appropriate digest.
===============================================================================
Digest Name: Daily Security Bulletins Digest
Created: Tue Jul 15 5:55:07 PDT 1997
Table of Contents:
Document ID Title
--------------- -----------
HPSBUX9707-065 Security Advisory in Netscape shipped with HP-UX
HPSBUX9707-064 Security Vulnerability in swinstall command
The documents are listed below.
-------------------------------------------------------------------------------
Document ID: HPSBUX9707-065
Date Loaded: 970715
Title: Security Advisory in Netscape shipped with HP-UX
-------------------------------------------------------------------------
HEWLETT-PACKARD SECURITY ADVISORY: #0065, 15 July 1997
-------------------------------------------------------------------------
The information in the following Security Advisory should be acted upon
as soon as possible. Hewlett Packard will not be liable for any
consequences to any customer resulting from customer's failure to fully
implement instructions in this Security Advisory as soon as possible.
-------------------------------------------------------------------------
PROBLEM: A problem has been identified in the Netscape Navigator.
PLATFORM: All platforms running Netscape Navigator 2.0, 3.0, and
Communicator 4.0.
DAMAGE: This vulnerability may allow a Web site operator to retrieve
known files from the hard disks of visiting users by mimicking
the submission of a form.
SOLUTION: Apply the workaround described below and in the Netscape web
site:
http://www.netscape.com/flash3/misc/security_update.html
AVAILABILITY: This advisory will be updated when patches are available
for HP-UX.
-------------------------------------------------------------------------
I.
A. Background - The problem applies to all versions of the
Netscape Navigator supplied by HP for HP-UX.
B. Fixing the problem - Apply the workaround:
NOTE - The Navigator 3.0 instructions also apply to Navigator 2.02.
==================================================================
Until patches are available, users of Navigator 3.0 and
Communicator 4.0 can take the following steps to enable warning
dialog boxes to detect and cancel form submissions:
In Navigator 3.0: Go to the Options menu and select Security
Preferences. Select the "Submitting a Form
Insecurely" preference to enable that warning
dialog box.
In Communicator 4.0: Select the lock in the toolbar to open the
Security Advisor. Select Navigator, then select
the "Sending Unencrypted Information to a Site"
preference to enable that warning dialog box.
===================================================================
C. Recommended solution - At this time the only solution is the
workaround. No patches are available currently for HP-UX.
D. Impact of the patch - N/A
E. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP Electronic Support Center via electronic mail,
do the following:
User your browser to get to the HP Electronic Support Center page:
http://us-support.external.hp.com
(for US, Canada, Asia-Pacific, & Latin-America)
http://europe-support.external.hp.com (for Europe)
Click on the Technical Knowledge Database, register as a user
(remember to save the User ID assigned to you, and your password),
and it will connect to a HP Search Technical Knowledge DB page.
Near the bottom is a hyperlink to our Security Bulletin archive.
Once in the archive there is another link to our current
security patch matrix. Updated daily, this matrix is categorized
by platform/OS release, and by bulletin topic.
F. To report new security vulnerabilities, send email to
security-alert@hp.com
Please encrypt any exploit information using the security-alert
PGP key, available from your local key server, or by sending a
message with a -subject- (not body) of 'get key' (no quotes) to
security-alert@hp.com.
Permission is granted for copying and circulating this Bulletin to
Hewlett-Packard (HP) customers (or the Internet community) for the
purpose of alerting them to problems, if and only if, the Bulletin
is not edited or changed in any way, is attributed to HP, and
provided such reproduction and/or distribution is performed for
non-commercial purposes.
Any other use of this information is prohibited. HP is not liable
for any misuse of this information by any third party.
________________________________________________________________________
-----End of Document ID: HPSBUX9707-065--------------------------------------
Document ID: HPSBUX9707-064
Date Loaded: 970715
Title: Security Vulnerability in swinstall command
-------------------------------------------------------------------------
HEWLETT-PACKARD SECURITY BULLETIN: #00064, 15 July 97
-------------------------------------------------------------------------
The information in the following Security Bulletin should be acted upon
as soon as possible. Hewlett Packard will not be liable for any
consequences to any customer resulting from customer's failure to fully
implement instructions in this Security Bulletin as soon as possible.
-------------------------------------------------------------------------
PROBLEM: Security Vulnerability in swinstall command
PLATFORM: HP 9000 Series 700/800s running HP-UX releases 9.X and 10.X
DAMAGE: Allows local users unauthorized root access.
SOLUTION: Apply the following patches as needed:
PHCO_10652 for HP-UX release 10.00 and 10.01,
PHCO_10028 for HP-UX release 10.10,
PHCO_11004 for HP-UX release 10.20,
PHCO_11185 for HP-UX release 10.16,
PHCO_11183 for HP-UX release 10.24.
For SD OV (released on 9.X) PHCO_11162 9.0[04]
PHCO_11161 9.0[1357]
AVAILABILITY: All patches are available now.
-------------------------------------------------------------------------
I.
A. Background
Hewlett-Packard Company has learned of a defect in the Software
Distributor (SD) product, as documented in CERT Advisory CA-96.27.
The patches mentioned herein remove the need for the workaround
published in that advisory.
B. Fixing the problem
Before continuing the use of SD, the system administrator needs to
obtain and apply the patches mentioned above.
C. Recommended solution
The patch is a cumulative libc patch and and fully fixes a
vulnerability discovered in the utility.
D. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP SupportLine Digest service via electronic
mail, do the following:
1) From your Web browser, access the URL:
http://us-support.external.hp.com
(for US,Canada, Asia-Pacific, and Latin-America)
http://europe-support.external.hp.com (for Europe)
2) On the HP Electronic Support Center main screen, select
the hyperlink "Support Information Digests".
3) On the "Welcome to HP's Support Information Digests" screen,
under the heading "Register Now", select the appropriate
hyperlink "Americas and Asia-Pacific", or "Europe".
4) On the "New User Registration" screen, fill in the fields for
the User Information and Password and then select the button
labeled "Submit New User".
5) On the "User ID Assigned" screen, select the hyperlink
"Support Information Digests".
** Note what your assigned user ID and password are for
future reference.
6) You should now be on the "HP Support Information Digests Main"
screen. You might want to verify that your email address is
correct as displayed on the screen. From this screen, you may
also view/subscribe to the digests, including the security
bulletins digest.
To get a patch matrix of current HP-UX and BLS security patches
referenced by either Security Bulletin or Platform/OS, click on
following screens in order:
Technical Knowledge Database
Browse Security Bulletins
Security Bulletins Archive
HP-UX Security Patch Matrix
E. To report new security vulnerabilities, send email to
security-alert@hp.com
Please encrypt any exploit information using the security-alert
PGP key, available from your local key server, or by sending a
message with a -subject- (not body) of 'get key' (no quotes) to
security-alert@hp.com.
Permission is granted for copying and circulating this Bulletin to
Hewlett-Packard (HP) customers (or the Internet community) for the
purpose of alerting them to problems, if and only if, the Bulletin is
not edited or changed in any way, is attributed to HP, and provided
such reproduction and/or distribution is performed for non-commercial
purposes.
Any other use of this information is prohibited. HP is not liable
for any misuse of this information by any third party.
_______________________________________________________________________
-----End of Document ID: HPSBUX9707-064--------------------------------------