Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-97.116 -- REVISED 01 Hewlett-Packard Security Bulletin: #00067
Buffer overflows in X11/Motif libraries.
10 September 1997
===========================================================================
Hewlett-Packard has released the following advisory concerning several
buffer overflows in X11/Motif libraries under HP-UX 9.X and 10.X. This
vulnerability may allow users to increase privileges.
The following security bulletin is provided as a service to AUSCERT's
members. As AUSCERT did not write this document, AUSCERT has had no
control over its content. As such, the decision to use any or all of this
information is the responsibility of each user or organisation, and should
be done so in accordance with site policies and procedures.
Contact information for HP is included in the Security Bulletin below.
If you have any questions or need further information, please contact them
directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/information/advisories.html
If you believe that your system has been compromised, contact AUSCERT or your
representative in FIRST (Forum of Incident Response and Security Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 4477
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AUSCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for emergencies.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -------------------------------------------------------------------------
**REVISED 01** HEWLETT-PACKARD SECURITY BULLETIN: #00067, 30 July 1997
Last Revised: 08 September 1997
- -------------------------------------------------------------------------
The information in the following Security Bulletin should be acted upon
as soon as possible. Hewlett Packard will not be liable for any
consequences to any customer resulting from customer's failure to fully
implement instructions in this Security Bulletin as soon as possible.
- -------------------------------------------------------------------------
PROBLEM: Buffer overflows in X11/Motif libraries.
PLATFORM: HP9000 Series 700/800 running releases 9.X and 10.X
DAMAGE: Suid/sgid programs linked with X11/Motif libraries can
be exploited to increase privileges.
SOLUTION: Install the patches listed below. Any programs that are
linked archived with any previous versions of the X11/Motif
libraries must be relinked with the libraries in the patches.
AVAILABILITY: The patches are available now.
CHANGE SUMMARY: Added patches for HP-UX 10.24.
- -------------------------------------------------------------------------
I.
A. Background - Several buffer overflow conditions have been
identified. These have been present in all
previous versions of the X11/Motif libraries.
B. Fixing the problem - Install the applicable patches:
**REVISED 01**
PHSS_11626 9.X X11R5/Motif1.2 Runtime
PHSS_11627 9.X X11R5/Motif1.2 Development
PHSS_11043 10.0X X11R5/Motif1.2 Runtime (also for 10.10)
PHSS_11044 10.0X X11R5/Motif1.2 Development
PHSS_11043 10.10 X11R5/Motif1.2 Runtime (also for 10.0X)
PHSS_11045 10.10 X11R5/Motif1.2 Development
PHSS_11628 10.20 X11R5/Motif1.2 Runtime
PHSS_11629 10.20 X11R5/Motif1.2 Development
PHSS_11628 10.20 X11R6/Motif1.2 Runtime
PHSS_11630 10.20 X11R6/Motif1.2 Development
-->>PHSS_11021 10.24 VVOS X/Motif Runtime July97 Periodic patch
PHSS_9858 9.X VUE 3.0
PHSS_9804 10.01 VUE 3.0
PHSS_9805 10.10/10.20 VUE 3.0
PHSS_11373 9.X JSE A.B9.40
Then relink any suid/sgid programs that use X11 or Motif archived
libraries.
C. Recommended solution - Install the applicable patches and
relink archived suid/sgid programs.
D. Impact of the patch - The fixes are in the X11/Motif patches.
The VUE and JSE patches make use of the libraries in the
X11/Motif patches.
E. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP Electronic Support Center via electronic
mail, do the following:
User your browser to get to the HP Electronic Support Center page
at:
http://us-support.external.hp.com
(for US, Canada, Asia-Pacific, & Latin-America)
http://europe-support.external.hp.com
(for Europe)
Click on the Technical Knowledge Database, register as a user
(remember to save the User ID assigned to you, and your password),
and it will connect to a HP Search Technical Knowledge DB page.
Near the bottom is a hyperlink to our Security Bulletin archive.
Once in the archive there is another link to our current
security patch matrix. Updated daily, this matrix is categorized
by platform/OS release, and by bulletin topic.
F. To report new security vulnerabilities, send email to
security-alert@hp.com
Please encrypt any exploit information using the security-alert
PGP key, available from your local key server, or by sending a
message with a -subject- (not body) of 'get key' (no quotes) to
security-alert@hp.com.
Permission is granted for copying and circulating this Bulletin to
Hewlett-Packard (HP) customers (or the Internet community) for the
purpose of alerting them to problems, if and only if, the Bulletin
is not edited or changed in any way, is attributed to HP, and
provided such reproduction and/or distribution is performed for
non-commercial purposes.
Any other use of this information is prohibited. HP is not liable
for any misuse of this information by any third party.
________________________________________________________________________
- -----End of Document ID: HPSBUX9707-067--------------------------------------
- --------------------------END INCLUDED TEXT--------------------
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key
iQCVAwUBNBZrpih9+71yA2DNAQEE3AP/ekFTZAZRQ0WZHOOyJQQoY2rilCcN4gdT
1CZ2tg4GqW0Gd1ReV/wd2BZLcWxscEK902L14RLndnfyZ9tUe5EepIe5ybabZvnI
I7DNRDOfmWrvYogSwjpnRb0I7Sv7iLd+kfQFw6Sw0gRPOYjtPtPfAuFMdhtvVXIZ
1NL5vn6tUjg=
=xqLF
-----END PGP SIGNATURE-----