Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2001.087 -- COMPAQ SSRT0708U Security Advisory Potential denial of Service in inetd Tru64 V5.1 Only 1 March 2001 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: inetd Vendor: Compaq Operating System: Tru64 V5.1 Impact: Denial of Service - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 *** NO RESTRICTIONS FOR DISTRIBUTION *** ======================================================= SOURCE: Compaq Computer Corporation SSRT0708U Software Security Response Team TITLE: Potential denial of Service in inetd Tru64 V5.1 Only (Compaq Case ID: SSRT0708U) Date: 23-FEB-2000 "Compaq is broadly distributing this Security Advisory in order to bring to the attention of users of Compaq products the important security information contained in this Advisory. Compaq recommends that all users determine the applicability of this information to their individual situations and take appropriate action. Compaq does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, Compaq will not be responsible for any damages resulting from user's use or disregard of the information provided in this Advisory." IMPACT: Versions Affected: Compaq's Tru64 UNIX V5.1 ONLY (all patch levels) A potential security vulnerability has been discovered for Tru64 UNIX V5.1, where under certain circumstances, there is a problem with the inetd Internet services daemon that can cause it to stop accepting connections. This causes all services handled by inetd to be inaccessible including ftp, telnet, rsh, rlogin, rexec, pop3, imap, radius, etc.. SEVERITY: Medium PROBLEM STATEMENT: This problem exists in Tru64 UNIX 5.1 inetd only. The /usr/sbin/inetd is the master daemon for many services. The inetd may stop responding to requests if one of its services cores as it is being started. Inetd continues to run. The netstat -An command may indicate many outstanding connections to the same PCB. If you are installing Open Source Internet Solutions on Tru64 UNIX Version 5.1, it is strongly urged that you install this patch kit. If you are installing Open Source Internet Solutions on a Tru64 UNIX Version 5.1 TruCluster system, you must install this patch kit prior to installing Open Source Internet Solutions because without it inetd failure during this procedure will cause an installation failure since it will interfere with intra-cluster communications. SOLUTION: Compaq Tru64 UNIX engineering has provided a fix for this potential problem for Tru64 UNIX V5.1 We apologize that this fix is not available from our patch site. If you determine that you need this fix please contact your normal Compaq Services support channel and request a patch using the reference SSRT0708U. This solution will be included in future releases of Tru64 UNIX V5.1 aggregate patch kits. To subscribe to automatically receive future NEW Security Advisories from the Software Security Response Team at Compaq via electronic mail, Use your browser to get to the http://www.support.compaq.com/patches/mailing-list.shtml and sign up. Select "Security and Individual Notices" for immediate dispatch notifications. Compaq appreciates your cooperation and patience. We regret any inconvenience applying this information may cause. As always, Compaq urges you to periodically review your system management and security procedures. Compaq will continue to review and enhance the security features of its products and work with customers to maintain and improve the security and integrity of their systems. (c) Copyright 2001 Compaq Computer Corporation. All rights reserved - -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBOpqE9agxZJFjvD74EQLz+gCfUxFEP5DKtCEBsNWYFTY/SHpn7h8AoPUA mcpPOt4BZd7RD6Awspq0MKWl =Wyrd - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the original authors to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/Information/advisories.html If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for emergencies. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBOp4fIyh9+71yA2DNAQFm3AP/dWtE2PP+VP+1wp/J35qfJ7B5Df8THuRC kqlY0t0Ics3UVN7ARjw4pt8oHBU5pg5R1ge2ebjl2tSWjKTqKKU/krIEg7159Jjs kr74uCvcNELPnWzFW4weeQRpmj409x7e5IyfXwTJVCXpCiQQeUjVYCtWWnD8tl/i zJ6dH8vcUts= =w8HJ -----END PGP SIGNATURE-----