ID: 3354
Date: 17 August 2007 10:43
Title: 3354 - HP Openview Security Advisories
Abstract: Description of a number of vulnerabilities in HP Openview
Vendors affected:Hewlett Packard
Applications affected:Openview
Warning Status: Imminent
Availability of fix: Available
Type of fix: Patch
Source: Hewlett Packard
Reliability of source: Trusted
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01106515
Version: 1
HPSBMA02235 SSRT061260 rev.1 - HP OpenView Internet Service (OVIS) Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP OpenView Internet Service (OVIS) running Shared Trace Service on HP-UX, Linux, Solaris, and Windows. The vulnerability could be remotely exploited to execute arbitrary code.
References: None
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Internet Service (OVIS) v6.00, v6.10, v6.11 (Japanese), v6.20 running HP OpenView Cross Platform Component (XPL) vB.60.81.00, vB.60.90.00, and vB.61.90.000 on HP-UX, Linux, Solaris, and Windows
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
To determine if a system has an affected version, search the output of "swlist -a revision -l fileset" for an affected fileset. Then determine if the recommended patch or update is installed.
AFFECTED VERSIONS
HP-UX B.11.11
HP-UX B.11.23
HP-UX B.11.31
=============
HPOvLcore.HPOVXPL
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
END AFFECTED VERSIONS
RESOLUTION
HP has provided a hotfix to resolve this vulnerability. Please contact HP Support and request the applicable hotfixes from the following url:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
MANUAL ACTIONS: Yes - NonUpdate
Install the hotfix
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all HP-issued Security Bulletins and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see:
https://www.hp.com/go/swa
HISTORY
Version: 1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrnh9eAfOvwtKn1ZEQIflgCgthVZ148gx2u14Ydq4rWwXWrXr78AoOBX
1K2c3ZwhVoHLt46eOq8NLiUw
=Y6SE
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01109617
Version: 1
HPSBMA02238 SSRT061260 rev.1 - HP OpenView Reporter Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP OpenView Reporter running Shared Trace Service. The vulnerability could be remotely exploited to execute arbitrary code.
References: None
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Reporter 3.7 running on Windows (2000, 2003, XP).
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
RESOLUTION
HP has provided a hotfix to resolve this vulnerability. Please contact HP Support and request the hotfix for QXCR1000390205:
http://openview.hp.com/ecare/getsupportdoc?docid=QXCR1000390205
PRODUCT SPECIFIC INFORMATION
HISTORY
Version: 1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrniSeAfOvwtKn1ZEQLflgCeMcC0+FRKUcCL9R8Nmk42ApQV1yIAoKwY
mZFEfi2q7Pde/e5kl6tmhLfF
=CQLb
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01109584
Version: 1
HPSBMA02237 SSRT061260 rev.1 - HP OpenView Performance Agent (OVPA) Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP OpenView Performance Agent (OVPA) running Shared Trace Service. The vulnerability could be remotely exploited to execute arbitrary code.
References: None
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Performance Agent (OVPA) 4.5 and 4.6 running on AIX (5L,5.1,5.2(Power3,4),5.3), HP Tru64 UNIX (5.1A,5.1B), HP-UX (B.11.11,B.11.23),
Linux: Debian Linux (3.0 and later), Redhat Linux (AS/ES/WS 2.1 and later), SuSE (9.0 and later), Turbo Linux (8.x and later), Solaris (5.7, 5.8, 5.9,10), Windows (2000,2003 and XP).
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
To determine if a system has an affected version, search the output of "swlist -a revision -l fileset" for an affected fileset. Then determine if the recommended patch or update is installed.
AFFECTED VERSIONS
HP-UX B.11.23 (IA)
=============
HPOvLcore.HPOVXPL
action: install revision 3.10.012 or subsequent
URL: http://openview.hp.com/ecare/getsupportdoc?docid=QXCR1000390205
HP-UX B.11.23 (PA)
HP-UX B.11.11
=============
HPOvLcore.HPOVXPL
action: install revision 3.10.012 or subsequent
URL: http://openview.hp.com/ecare/getsupportdoc?docid=QXCR1000390205
END AFFECTED VERSIONS
RESOLUTION
HP has provided a hotfix to resolve this vulnerability. Please contact HP Support and request the hotfix for QXCR1000390205:
http://openview.hp.com/ecare/getsupportdoc?docid=QXCR1000390205
MANUAL ACTIONS: Yes - NonUpdate
Install the hotfix
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all HP-issued Security Bulletins and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see:
https://www.hp.com/go/swa
HISTORY
Version: 1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrniKuAfOvwtKn1ZEQI14ACgiPTRcnlHIM1Q87Q8lhbO5cSZSAIAoPZO
jd/qjAs1jKsq73Q/06RLRjxb
=baUS
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01110576
Version: 1
HPSBMA02239 SSRT061260 rev.1 - HP OpenView Operations (OVO) Agents Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified in HP OpenView Operations (OVO) Agents running Shared Trace Service. The vulnerability could be remotely exploited to execute arbitrary code.
References: none
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView OVO Agents OVO8.x HTTPS agents on AIX, HP-UX (IA and PA), Solaris, and Windows.
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
To determine if a system has an affected version, search the output of "swlist -a revision -l fileset" for an affected fileset. Then determine if the recommended patch or update is installed.
AFFECTED VERSIONS
HP-UX B.11.11
HP-UX B.11.23
HP-UX B.11.31
===========
OVO-CLT.OVO-UX11-CLT
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
OVO-CLT.OVO-UXIA-CLT
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
OVO-CLT.OVO-SOL-CLT
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
OVO-CLT.OVO-WIN-CLT
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
OVO-CLT.OVO-LIN-CLT
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
OVO-CLT.OVO-AIX-CLT
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
OVO-CLT.OVO-TRU-CLT
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
END AFFECTED VERSIONS
RESOLUTION
HP has made the following patches available to resolve the vulnerability. The patches can be downloaded from http://itrc.hp.com
Patches are not yet available for all client systems. Until patches are available HP has provided a hotfix to resolve this vulnerability. Please contact HP Support and request the applicable hotfixes from the following url:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
Each patch is to be installed on the operating system listed in the "System to be Patched" column. Each patch is for communication with the operating system listed in the "Client System" column.
Patch (or subsequent) System to be Patched Client System
==============================================================
Install hotfix HP-UX PA HP-UX PA
Install hotfix HP-UX PA HP-UX IA
Install hotfix HP-UX PA Solaris
Install hotfix HP-UX PA Windows
PHSS_36278 HP-UX PA Linux
Install hotfix HP-UX PA AIX
Install hotfix Solaris HP-UX PA
Install hotfix Solaris HP-UX IA
Install hotfix Solaris Solaris
Install hotfix Solaris Windows
ITOSOL_00586 Solaris Linux
Install hotfix Solaris AIX
MANUAL ACTIONS: Yes - NonUpdate
Install hotfix
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all HP-issued Security Bulletins and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see:
https://www.hp.com/go/swa
HISTORY
Version:1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrniW+AfOvwtKn1ZEQJ2NwCfaZPAOKToWp7Bay0X4L4735sDmnMAni7x
8gh2XCU7Mdr1adef5m6uBSke
=ZV2u
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01111851
Version: 1
HPSBMA02241 SSRT061260 rev.1 - HP OpenView Service Quality Manager (OV
SQM) Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP OpenView Service Quality Manager (OV SQM) running Shared Trace Service. The vulnerability could be remotely exploited to execute arbitrary code.
References: None
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Quality Manager (OV SQM) v1.2 SP1, v1.3, v1.40 running HP OpenView Cross Platform Component (XPL) 2.60.041, 2.61.060 and 2.61.110 on HP-UX and Windows
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
To determine if a system has an affected version, search the output of "swlist -a revision -l fileset" for an affected fileset. Then determine if the recommended patch or update is installed.
AFFECTED VERSIONS
HP-UX B.11.11
=============
HPOvLcore.HPOVXPL
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
END AFFECTED VERSIONS
RESOLUTION
HP has provided a hotfix to resolve this vulnerability. Please contact HP Support and request the applicable hotfixes from the following url:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
MANUAL ACTIONS: Yes - NonUpdate
Install the hotfix
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all HP-issued Security Bulletins and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see:
https://www.hp.com/go/swa
HISTORY
Version: 1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrnih+AfOvwtKn1ZEQLSAACg8om7hpti3OEc7LFfgiqtGC03WKAAoIs9
2j1E4qS7b0ukZ/oFWF5QE/cu
=QUZY
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01114156
Version: 1
HPSBMA02245 SSRT061260 rev.1 - HP OpenView Dashboard Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP OpenView Dashboard running Shared Trace Service. The vulnerability could be remotely exploited to execute arbitrary code.
References: None
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Dashboard v2.01 running HP OpenView Cross Platform Component
(XPL) vB.60.90.00 and vB.61.90.000 on Windows, Solaris and HP-UX.
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
To determine if a system has an affected version, search the output of "swlist -a revision -l fileset" for an affected fileset. Then determine if the recommended patch or update is installed.
AFFECTED VERSIONS
HP-UX B.11.11
=============
HPOvLcore.HPOVXPL
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
END AFFECTED VERSIONS
RESOLUTION
HP has provided a hotfix to resolve this vulnerability. Please contact HP Support and request the applicable hotfixes from the following url:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
MANUAL ACTIONS: Yes - NonUpdate
Install the hotfix
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all HP-issued Security Bulletins and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see:
https://www.hp.com/go/swa
HISTORY
Version: 1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrni1eAfOvwtKn1ZEQJ4MACcDK0AFa1fwlxOduvsLFCuAaK2PGMAnAy2
GLsHVja4c09+Zc+xhgkiBfmL
=wCxl
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01112038
Version: 1
HPSBMA02242 SSRT061260 rev.1 - HP OpenView Network Node Manager (OV NNM) Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential vulnerability has been identified with HP OpenView Network Node Manager (OV NNM) running Shared Trace Service. The vulnerability could be remotely exploited to execute arbitrary code.
References: None
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Network Node Manager (OV NNM) v6.41, v7.01, v7.50 running XPL earlier than 03.10.040 on HP-UX, Solaris, Windows NT, Windows 2000, Windows XP, and Linux
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
Note: To determine if HP-UX has an affected version, search the output of "swlist -a revision -l fileset" for an affected fileset. Then determine if the recommended patch or update is installed.
AFFECTED VERSIONS
HP-UX B.11.00
HP-UX B.11.11
HP-UX B.11.23
HP-UX B.11.31
=============
HPOvLcore.HPOVXPL
action: install the XPL_COMPONENT_3.10.040 as discussed in the Resolution section
END AFFECTED VERSIONS
RESOLUTION
HP has made the following procedure available to resolve the vulnerability.
1. Install the following patches. These patches are available on:
http://itrc.hp.com
OpenView Network Node Manager 6.41
HP-UX (PA)
PHSS_35830 or subsequent
Solaris
PSOV_03469 or subsequent
Windows 2000, Windows XP
NNM_01148 or subsequent
OpenView Network Node Manager 7.01
HP-UX (PA)
PHSS_35579 or subsequent
Solaris
PSOV_03468 or subsequent
Windows 2000, Windows XP
NNM_01147 or subsequent
OV NNM 7.50
HP-UX (PA)
PHSS_36385 or subsequent
HP-UX (IA)
PHSS_36386 or subsequent
Solaris
PSOV_03479 or subsequent
Windows 2000, Windows XP
NNM_01158 or subsequent
Linux RedHatAS2.1
LXOV_00052 or subsequent
Note: The patches listed above do not resolve the vulnerability. They
are needed for compatibility with XPL 03.10.040, which does resolve the
vulnerability.
2. Download the appropriate XPL_COMPONENT_3.10.040 file from the
following site into a secure directory:
ftp://cme_xpl:0310040@hprc.external.hp.com/
HP-UX (PA-RISC)
XPL_COMPONENT_3.10.040_HPUX.tar.gz
HP-UX (Itanium)
XPL_COMPONENT_3.10.040_IPF.tar.gz
Linux (RHEL2.1 AS)
XPL_COMPONENT_3.10.040_Linux.tar.gz
Solaris
PL_COMPONENT_3.10.040_SOL.tar.gz
Windows
XPL_COMPONENT_3.10.040_Win.zip
3. Unpack the gz files using gunzip.
4. Verify the cksum or md5sum:
765964855 13967360 XPL_COMPONENT_3.10.040_HPUX.tar
964115406 22978560 XPL_COMPONENT_3.10.040_IPF.tar
1071892883 2324480 XPL_COMPONENT_3.10.040_Linux.tar
2657852015 11857920 XPL_COMPONENT_3.10.040_SOL.tar
1507786934 1510091 XPL_COMPONENT_3.10.040_Win.zip
MD5 (XPL_COMPONENT_3.10.040_HPUX.tar) = 15cfc5f312ea192fcef5acf1f71b0f8a
MD5 (XPL_COMPONENT_3.10.040_IPF.tar) = 86743b9a9585915f20e31c7da85fda69
MD5 (XPL_COMPONENT_3.10.040_Linux.tar) =
1c30fae89c3682e5bb7d7e2747fcd734
MD5 (XPL_COMPONENT_3.10.040_SOL.tar) = 4cd395f2f5b4a3c8aef34131643c1751
MD5 (XPL_COMPONENT_3.10.040_Win.zip) = 3504a9c04b7f8f9502455043e07fb29d
5. Unpack the tar or zip file into a secure directory.
6. Execute the appropriate installation script: install.sh or
install.bat.
MANUAL ACTIONS: Yes
Install XPL_COMPONENT_3.10.040.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced
application that replaces HP-UX Security Patch Check. It analyzes all
HP-issued Security Bulletins and lists recommended actions that may
apply to a specific HP-UX system. It can also download patches and
create a depot automatically. For more information see:
https://www.hp.com/go/swa
HISTORY
Version: 1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to
be installed on systems running HP software products should be applied
in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support
channel.
Report: To report a potential security vulnerability with any HP
supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being
communicated to HP be encrypted using PGP, especially exploit
information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security
Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit
Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrnim+AfOvwtKn1ZEQJOGACeMrmNkI1qO6V3X9Y6pvC4H7us4f4An2J3
ETe8l8rHxPi1NygvNjz+gZN9
=hYhs
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01115068
Version: 1
HPSBMA02246 SSRT061260 rev.1 - HP OpenView Performance Insight (OVPI) Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP OpenView Performance Insight (OVPI) running Shared Trace Service. The vulnerability could be remotely exploited to execute arbitrary code.
References: None
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Performance Insight (OVPI) v5.0, v5.1, v5.1.1, v5.1.2, v5.2 running HP OpenView Cross Platform Component (XPL) earlier than v3.10.040 on HP-UX Precision Architecture (PA), HP-UX Itanium (IA), Linux, Solaris, and Windows
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
To determine if a system has an affected version, search the output of "swlist -a revision -l fileset" for an affected fileset. Then determine if the recommended patch or update is installed.
AFFECTED VERSIONS
HP-UX B.11.11
HP-UX B.11.23
HP-UX B.11.31
=============
HPOvLcore.HPOVXPL
action: install revision 3.10.040 or subsequent
URL:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
END AFFECTED VERSIONS
RESOLUTION
HP has provided a hotfix to resolve this vulnerability. Please contact HP Support and request the applicable hotfixes from the following url:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
MANUAL ACTIONS: Yes - NonUpdate
install revision 3.10.040 or subsequent
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all HP-issued Security Bulletins and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see:
https://www.hp.com/go/swa
HISTORY
Version: 1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective own
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrni7eAfOvwtKn1ZEQKbBgCgpgs0hbQDxwoB1lQgaowCu3fuy5QAoM6W
FjTUW3VICuURZPFmkS+HSpyy
=zeNq
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01114023
Version: 1
HPSBMA02244 SSRT061260 rev.1 - HP OpenView Business Process Insight and Related Products Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with the HP OpenView Business Process Insight family of products running Shared Trace Service on Windows. The vulnerability could be remotely exploited to execute arbitrary code. The HP OpenView Business Process Insight family of products includes HP OpenView Business Process Insight (OVBPI) ,HP Business Process Insight (HPBPI) , HP OpenView Service Desk Process Insight (SDPI), and HP Service Desk Process Insight (HPSDPI).
References: None
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Business Process Insight (OVBPI), HP Business Process Insight (HPBPI) , HP OpenView Service Desk Process Insight (SDPI), and HP Service Desk Process Insight (HPSDPI) versions 1.0, 1.1x, 2.0x and 2.10x on Windows running Shared Trace Service from the HP OpenView Cross Platform Component prior to v3.10.040.
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
To determine if a system has an affected version, search the "HP OpenView Cross Platform Component" in the Add/Remove program list. If the version listed in the Support Information is earlier than 3.10.040, install the patch as described in the Resolution section (below).
RESOLUTION
HP has provided the following patch to resolve this vulnerability.
OVBPI_00014 or subsequent
The patch is available from:
http://support.openview.hp.com/patches/ovbpi/02.10/win.jsp
Download the patch which contains an install image of the HP OpenView Cross Platform Component (XPL) containing the Shared Trace Service.
Execute the installer and follow the onscreen instructions.
Note: By default the HP Business Process Insight family installer does not install the affected Shared Trace Service component. It is installed by explicitly running the XPL installer included on the HPBPI media. It may also have been installed it along with another HP OpenView software product. Please check with the support channel to see if other HP OpenView components on the system may be affected.
PRODUCT SPECIFIC INFORMATION
HISTORY
Version: 1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrniwuAfOvwtKn1ZEQI1+QCgz03LPMXO40qtzK9iUxhLUIUfPtkAoPWc
QaUvJgRixtVmi2BV11iaRCef
=BsDl
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01110627
Version: 1
HPSBMA02240 SSRT061260 rev.1 - HP OpenView Operations Manager for Windows (OVOW) with the OpenView Operations Add On Module for OpenView Operations-Business Availability Center Integration Running Shared Trace Service, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2007-08-07
Last Updated: 2007-08-07
Potential Security Impact: Remote arbitrary code execution
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP OpenView Operations Manager for Windows (OVOW) with the OpenView Operations (OVO) add on module for OpenView Operations-Business Availability Center
(OVO-BAC) integration running Shared Trace Service. The vulnerability could be remotely exploited to execute arbitrary code.
References: None
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Operations Manager for Windows (OVOW) v7.5 with the OpenView Operations (OVO) add on module for OpenView Operations-Business Availability Center (OVO-BAC) integration running Shared Trace Service.
BACKGROUND
The Hewlett-Packard Company thanks Cody Pierce of TippingPoint DV Labs
(dvlabs.tippingpoint.com) for reporting this vulnerability to security-alert@hp.com.
The Hewlett-Packard Company thanks an anonymous researcher working with the iDefense VCP for reporting this vulnerability to security-alert@hp.com.
To determine if a system has an affected version, search the "HP OpenView Cross Platform Component" in the Add/Remove program list. If the version listed in the Support Information is earlier than 3.10.040, install the hotfix as described in the Resolution section (below).
RESOLUTION
HP has provided a hotfix to resolve this vulnerability. Please contact HP Support and request the applicable hotfix from the following url:
http://quixy.deu.hp.com/hotfix/d.php?P=lcore&N=SSRT061260+OpenView+Share
d+Trace+Service&V=2.1
The url above contains hotfixes for several operating systems. HP OpenView Operations Manager for Windows v7.5 customers running the OVO add-on module for the OVO-BAC integration only need the WINDOWS XPL
hotfix: HPOvXpl-03.10.040-WinNT4.0-release.msi
PRODUCT SPECIFIC INFORMATION
HISTORY
Version: 1 (rev.1) - 7 August 2007 Initial release
Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as
follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=
USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to
is represented by the 5th and 6th characters of the Bulletin number in
the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to
the attention of users of the affected HP products the important
security information contained in this Bulletin. HP recommends that all
users determine the applicability of this information to their
individual situations and take appropriate action. HP does not warrant
that this information is necessarily accurate or complete for all user
situations and, consequently, HP will not be responsible for any damages
resulting from user's use or disregard of the information provided in
this Bulletin. To the extent permitted by law, HP disclaims all
warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose, title and
non-infringement."
(c)Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is
provided "as is" without warranty of any kind. To the extent permitted
by law, neither HP or its affiliates, subcontractors or suppliers will
be liable for incidental, special or consequential damages including
downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or
software restoration. The information in this document is subject to
change without notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRrnib+AfOvwtKn1ZEQIUnACgzPX6aovMPrR1Upfg4ImJksYIYc0AnRL5
qXSYDVvfFD6o2P2H3ykIMZow
=M+gD
-----END PGP SIGNATURE-----
This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.
The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.
CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.