Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0880
HPSBNS02880 rev.1 - HP NonStop Servers running SQL/MX using SQL/MP Objects,
Remote Unauthorized Disclosure of Information and Data Modification
25 June 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: HP NonStop Servers
Publisher: Hewlett-Packard
Operating System: UNIX specific
Impact/Access: Access Privileged Data -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2013-2323 CVE-2013-2322
Original Bulletin:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03762155
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Note: the current version of the following document is available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03762155
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03762155
Version: 1
HPSBNS02880 rev.1 - HP NonStop Servers running SQL/MX using SQL/MP Objects,
Remote Unauthorized Disclosure of Information and Data Modification
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
Release Date: 2013-06-24
Last Updated: 2013-06-24
Potential Security Impact: Remote unauthorized disclosure of information,
data modification
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Two potential vulnerabilities have been identified with HP NonStop Servers
running SQL/MX using SQL/MP Objects. The first vulnerability, SQL/MP index,
could be remotely exploited by an authenticated user resulting in disclosure
of information. The second vulnerability, SQL/MP tables, could be remotely
exploited by an authenticated user to bypass security restrictions resulting
in unauthorized data modification.
References: CVE-2013-2322 (SQL/MP index), CVE-2013-2323 (SQL/MP tables),
SSRT101037
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
SQL/MP index (CVE-2013-2322) impacts HP NonStop SQL/MX release 3.2 and
earlier.
SQL/MP tables (CVE-2013-2323) impacts HP NonStop SQL/MX releases 3.0, 3.1 and
3.2 only.
Note: For Release Version Updates (RVUs) J06.11/H06.22 through J06.13/H06.24,
the version of SQL/MX shipped on Site Update Tapes (SUTs) was 2.3.x.
Beginning with J06.14/H06.25, the version of SQL/MX shipped on SUTs was 3.x.
Affected Software Product Revisions (SPRs):
SQL/MX 3.x versions (both vulnerabilities)
SQL/MP index vulnerability:
T1050 SQL/MX MXCMP SPRs:
T1050H32
T1050H31^APK
T1050H31^AOW
T1050H31^AON
T1050H31
T1050H30^AOX
T1050H30^ANW
T1050H30
Release Version Updates containing the defective SPRs:
J06.14
J06.14.01
H06.25
Additional Release Version Updates potentially affected because one or more
of the defective SPRs is usable with them:
J06.11
J06.11.01
J06.12
J06.13
J06.13.01
J06.15
H06.22
H06.22.01
H06.23
H06.24
H06.24.01
H06.26
SQL/MP tables vulnerability:
T1051 SQL/MX EXE SPRs:
T1051H32
T1050H31^APO
T1051H31^AON
T1051H31
T1051H31
T1051H30^ANW
T1051H30
Release Version Updates containing the defective SPRs:
J06.14
J06.14.01
H06.25
Additional Release Version Updates potentially affected because one or more
of the defective SPRs are usable with them:
J06.11
J06.11.01
J06.12
J06.13
J06.13.01
J06.15
H06.22
H06.22.01
H06.23
H06.24
H06.24.01
H06.26
SQL/MX 2.3.x versions: (SQL/MP index vulnerability)
T1050 SQL/MX MXCMP SPRs:
T1050H23
T1050H23^AEQ
T1050H23^AFJ
T1050H23^AFV
T1050H23^AGF
T1050H23^AHN
T1050H23^AHY
T1050H23^AIE
T1050H23^AIF
T1050H23^AIV
T1050H23^AJB
T1050H23^AJD
T1050H23^AJG
T1050H23^AJM
T1050H23^AJT
T1050H23^AKD
T1050H23^AKL
T1050H23^AKN
T1050H23^ALK
T1050H23^ANC
T1050H23^AND
T1050H23^ANF
T1050H23^ANG
T1050H23^ANJ
T1050H23^ANK
T1050H23^ANL
T1050H23^ANO
T1050H23^ANR
T1050H23^ANS
T1050H23^ANZ
T1050H23^AOA
T1050H23^AOG
T1050H23^AOH
T1050H23^AOK
T1050H23^AOQ
T1050H23^AOU
T1050H23^AOZ
T1050H23^APJ
Release Version Updates containing the defective SPRs:
J06.03
J06.04
J06.04.01
J06.04.02
J06.05
J06.05.01
J06.05.02
J06.06
J06.06.01
J06.06.02
J06.06.03
J06.07
J06.07.01
J06.07.02
J06.08
J06.08.01
J06.08.02
J06.08.03
J06.08.04
J06.09
J06.09.01
J06.09.02
J06.09.03
J06.09.04
J06.10
J06.10.01
J06.10.02
J06.11
J06.11.01
J06.12
J06.13
J06.13.01
H06.10
H06.10.01
H06.11
H06.11.01
H06.11.02
H06.11.03
H06.12
H06.13
H06.14
H06.15
H06.15.01
H06.15.02
H06.16
H06.16.01
H06.16.02
H06.17
H06.17.01
H06.17.02
H06.17.03
H06.18
H06.18.01
H06.18.02
H06.19
H06.19.01
H06.19.02
H06.19.03
H06.20
H06.20.01
H06.20.02
H06.20.03
H06.21
H06.21.01
H06.21.02
H06.22
H06.22.01
H06.23
H06.24
H06.24.01
SQL/MX 1.8, 2.0, 2.1 and 2.2 versions: (SQL/MP index vulnerability)
T1050 SQL/MX MXCMP SPRs:
T1050H22^ACF
T1050H22^ACO
T1050H22^ACX
T1050H22^ACY
T1050H22^ADJ
T1050H22^ADL
T1050H22^ADO
T1050H22^ADW
T1050H22^AEF
T1050H22^AEI
T1050H22^AEM
T1050H22^AEZ
T1050H22^AFR
T1050H22^AGH
T1050H22^AGY
T1050H22^AHD
T1050H22^AID
T1050H22^AJE
T1050H22^ALI
T1050G08^AAI
T1050G08^AAJ
T1050G08^AAM
T1050G08^AAP
T1050G08^AAR
T1050G08^AAV
T1050G08^AAX
T1050G08^ABC
T1050G08^ABI
T1050G08^ABK
T1050G08^ABS
T1050G08^ABW
T1050G08^ABZ
T1050G08^ACQ
T1050G08^ACW
T1050G10^ABA
T1050G10^ABJ
T1050G10^ABL
T1050G10^ABQ
T1050G10^ACB
T1050G10^AES
T1050G21^ABU
T1050G21^ABX
T1050G21^ACC
T1050G21^ACH
T1050G21^ACM
T1050G21^ACN
T1050G21^ADT
T1050G21^ADV
T1050G21^AEL
T1050G21^AEO
T1050G21^AHC
T1050G21^ALA
Release Version Updates containing the defective SPRs:
H06.03.00
H06.03.01
H06.04.00
H06.05.00
H06.05.01
H06.05.02
H06.06.00
H06.07.00
H06.07.01
H06.08.00
H06.09.00
G06.18
G06.19
G06.20
G06.21
G06.22
G06.23
G06.24
G06.25
G06.26
G06.27
G06.28
G06.29
G06.29.01
G06.29.02
G06.29.03
G06.30
G06.30.01
G06.30.02
G06.31
G06.31.01
G06.32
G06.32.01
l
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2013-2322 (AV:N/AC:M/Au:S/C:P/I:N/A:N) 3.5
CVE-2013-2323 (AV:N/AC:H/Au:S/C:P/I:P/A:P) 4.6
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has made the following software updates available to resolve the
vulnerabilities.
RVUs containing final fix (both vulnerabilities):
SQL/MX 3.2.1
J06.14.02
J06.15
H06.25.01
H06.26
SQL/MX 3.2
None
SQL/MX 3.1
None
SQL/MX 3.0
No fix for either vulnerability is planned
SQL/MX 2.1 and 2.2
No fix for the SQL/MP index vulnerability is planned
G-Series
No fix for the SQL/MP index vulnerability is planned
Fix (SQL/MP index vulnerability):
Install the appropriate SPRs for T1050 SQL/MX MXCMP as shown below, depending
on your release version.
SQL/MX R3.2: T1050H32 APW already available
This SPR already is present in these RVUs: None
This SPR is usable with the following RVUs:
J06.14
J06.14.01
J06.15
H06.25
H06.26
SQL/MX R3.1: T1050H31 APV already available
This SPR already is present in these RVUs: None
This SPR is usable with the following RVUs:
J06.12
J06.13
J06.13.01
J06.14
J06.14.01
J06.15
H06.23
H06.24
H06.24.01
H06.25
H06.26
SQL/MX R2.3: T1050H23 APN already available
This SPR already is present in these RVUs: None
This SPR is usable with the following RVUs:
J06.03
J06.04
J06.04.01
J06.04.02
J06.05
J06.05.01
J06.05.02
J06.06
J06.06.01
J06.06.02
J06.06.03
J06.07
J06.07.01
J06.07.02
J06.08
J06.08.01
J06.08.02
J06.08.03
J06.08.04
J06.09
J06.09.01
J06.09.02
J06.09.03
J06.09.04
J06.10
J06.10.01
J06.10.02
J06.11
J06.11.01
J06.12
J06.13
J06.13.01
J06.14
J06.15
H06.14
H06.15
H06.15.01
H06.15.02
H06.16
H06.16.01
H06.16.02
H06.17
H06.17.01
H06.17.02
H06.17.03
H06.18
H06.18.01
H06.18.02
H06.19
H06.19.01
H06.19.02
H06.19.03
H06.20
H06.20.01
H06.20.02
H06.20.03
H06.21
H06.21.01
H06.21.02
H06.22
H06.22.01
H06.23
H06.24
H06.24.01
H06.25
H06.26
Fix (SQL/MP tables vulnerability)
Install the appropriate SPRs for T1051 SQL/MX EXE as shown below, depending
on your release version.
SQL/MX R3.2: T1051H32 APW already available
This SPR already is present in these RVUs:
J06.14.02
H06.25.01
This SPR is usable with the following RVUs:
J06.14
J06.14.01
J06.15
H06.25
H06.26
SQL/MX R3.1: T1051H31 APL already available
This SPR already is present in these RVUs: None
This SPR also is usable with the following RVUs:
J06.12
J06.13
J06.13.01
J06.14
J06.15
H06.23
H06.24
H06.24.01
H06.25
H06.26
You can check with the GNSC for applicability of this SPR to RVURs released
since publication of this security bulletin.
Installation impact: If the T1051 fix is applied, SYSGEN is required. This
applies to the SQL/MP tables vulnerability.
If the T1050 fix is applied, applications need to be recompiled after SPR
installation in order to avoid the problem described. This applies to the
SQL/MP index vulnerability.
Please refer to the appropriate softdoc(s) for detailed SPR information,
including installation instructions, superseded SPRs, and requisite SPR
lists. Note that in some cases, requisite SPRs might have greater
installation impact than the SPRs described in this security bulletin.
HISTORY
Version:1 (rev.1) - 24 June 2013 Initial release
Third Party Security Patches: Third party security patches that are to be
installed on systems running HP software products should be applied in
accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HP Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported
product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin
alerts via Email:
http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin Archive: A list of recently released Security Bulletins is
available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
Copyright 2013 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors
or omissions contained herein. The information provided is provided "as is"
without warranty of any kind. To the extent permitted by law, neither HP or
its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits;damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice.
Hewlett-Packard Company and the names of Hewlett-Packard products referenced
herein are trademarks of Hewlett-Packard Company in the United States and
other countries. Other product and company names mentioned herein may be
trademarks of their respective owners.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iEYEARECAAYFAlHIob8ACgkQ4B86/C0qfVkMfQCfYIOp5Ja3LSmXuE5g43XX9+GP
OyQAnRjo/HVB9RIE5aSAVPTSMGZ4o4M6
=E2Fs
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUcjjaRLndAQH1ShLAQJt5BAAtQ/TJt4fmDWxlKEzwShI+tV5SIpsrrSk
lpxa5wb1DlsjiJqH/rTkQvsqLmYQdotYR8HSiLKZuvQCNMsQ0ia11QBTLH6+WX1x
2pWk1tyb1qzGMJbggfGFhpD/kfB2EWGKMNnRzko5z+CGII79ICF/0a5xE0QoPKD6
/j6iYD2kWqFznXZYvJZ3cr84+f64Gb+BweBPxuTSQT/KjpMFKIegY7PDHEC6MMkt
wpp4W8W0R984NfSRVpw9TklyeIY86KA/Lpg/Jn/w6yY7FznYpEd7Hx1gUuBxpOni
C8FNAnesSyh+b/OB7S0b0dVakNgWoKKYZ1y4y676u5img2SXZ0SYKHg4817G25Kw
BhehEaZvqoXHxlNq7rijRF5tQG7f7e4HD9e/PTvuAvobyk8gRx6ux9IwpRd2UcdH
oPCu//v8mtcNFmp0ULn+ga6taN+kOYkfTXav1AqX1JKQ+dz5ffdUd/dt1LdnN61R
GvrybBcQkYNjWCkT5mhVQ0XOa12feXftSCt/K4AVMUptZP2oEUzQaP7MmMCXy4J7
/uCzIIAHX5z0rzgnMypsSEw1wW4xP3Ezf0a9ArgLUkoLoOr92s9m2QHCN/HFJ8Yp
vF0haeEzI5rUT7+/GqXJXvh6sjwmdcFLxqGsiamNyrX3Z15sSYrZNgztwrQtyeoD
7rfYxKYgrcY=
=OVZg
-----END PGP SIGNATURE-----