----BEGIN PGP SIGNED MESSAGE-----
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c02026642
HPSBUX02509 SSRT100032 rev.1 - HP-UX Running NFS/ONCplus, NFS Inadvertently Enabled
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2010-03-25
Last Updated: 2010-03-25
Potential Security Impact: NFS inadvertently enabled
Source: Hewlett-Packard Company, HP Software Security Response Team
A potential security vulnerability has been identified with NFS/ONCplus running on HP-UX. The vulnerability could result in the inadvertent enabling of NFS.
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.31 running NFS / ONCplus version B.11.31_08 or previous
CVSS 2.0 Base Metrics
Reference Base Vector Base Score
CVE-2010-0451 (AV:N/AC:H/Au:N/C:P/I:P/A:N) 4.0
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
Installing ONCplus will result in having NFS_SERVER=1 in /etc/rc.config.d/nfsconf regardless of the original setting. This can result in inadvertently enabling NFS.
HP has provided an upgrade to resolve this vulnerability.
This upgrade is available from the following location.
HP-UX Release / Depot name
B.11.31 / Install ONCplus_B.11.31.09.depot or subsequent
MANUAL ACTIONS: Yes - Update
Install ONCplus_B.11.31.09.depot to preserve NFS_SERVER value when updating.
Check and correct NFS_SERVER and NFS_CLIENT values.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
HP-UX B.11.31 (IA)
action: install revision B.11.31.09 or subsequent
END AFFECTED VERSIONS
Version:1 (rev.1) 25 March 2010 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: XXXX@XXXXX.COM
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail me