FW: COMPAQ SSRT0708U Security Advisory Tru64 V5.1 (only) inetd

[Ben Greenbaum <bgreenbaum () SECURITYFOCUS COM>]

---------- Forwarded message ----------
Date: Mon, 26 Feb 2001 10:44:04 -0600
From: "Boren, Rich" <Rich.Boren () COMPAQ com>
To: "'bgreenbaum () securityfocus com'" <bgreenbaum () securityfocus com>
Subject: FW: COMPAQ  SSRT0708U Security Advisory Tru64 V5.1 (only) inetd

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


             *** NO RESTRICTIONS FOR DISTRIBUTION ***
=======================================================
 SOURCE:  Compaq Computer Corporation                SSRT0708U
                    Software Security Response Team

  TITLE:  Potential denial of Service in inetd Tru64 V5.1 Only
                (Compaq Case ID: SSRT0708U)

   Date:  23-FEB-2000

  "Compaq is broadly distributing this Security Advisory in order
  to bring to the attention of users of Compaq products the
  important security information contained in this Advisory.
  Compaq recommends that all users determine the applicability of
  this information to their individual situations and take
  appropriate action.

  Compaq does not warrant that this information is necessarily
  accurate or complete for all user situations and, consequently,
  Compaq will not be responsible for any damages resulting from
  user's use or disregard of the information provided in this
  Advisory."

  IMPACT:

  Versions Affected:
   Compaq's Tru64 UNIX  V5.1 ONLY (all patch levels)

   A potential security vulnerability has been discovered for
   Tru64 UNIX V5.1, where under certain circumstances, there
   is a problem with the inetd Internet services daemon that can
   cause it to stop accepting connections.   This causes all
   services handled by inetd to be inaccessible including ftp,
   telnet, rsh, rlogin, rexec, pop3, imap,  radius, etc..


  SEVERITY: Medium

  PROBLEM STATEMENT:

   This problem exists in Tru64 UNIX 5.1 inetd only. The
   /usr/sbin/inetd is the master daemon for many services.
   The inetd may stop responding to requests if one of its
   services cores as it is being started. Inetd continues to run.
   The netstat -An command may indicate many outstanding
   connections to the same PCB.

   If you are installing Open Source Internet Solutions on Tru64 UNIX
   Version 5.1, it is strongly urged that you install this patch kit.

   If you are installing Open Source Internet Solutions
   on a Tru64 UNIX Version 5.1 TruCluster system, you must
   install this patch kit prior to installing Open Source
   Internet Solutions  because without it inetd failure during
   this procedure will cause an installation failure since it will
   interfere with intra-cluster communications.

  SOLUTION:

  Compaq Tru64 UNIX engineering has provided a fix for this potential
  problem for Tru64 UNIX V5.1

  We apologize that this fix is not available from our patch site. If
  you determine that you need this fix please contact your
  normal Compaq  Services support channel and  request a
  patch using the reference SSRT0708U.

  This solution will be included in future releases of Tru64 UNIX
  V5.1 aggregate patch kits.

   To subscribe to automatically receive future NEW Security
   Advisories from the Software Security Response Team at
   Compaq via electronic mail,

   Use your browser to get to the
   http://www.support.compaq.com/patches/mailing-list.shtml
   and sign up.   Select "Security and Individual Notices" for
   immediate dispatch notifications.

  Compaq appreciates your cooperation and patience. We regret any
  inconvenience applying this information may cause.

  As always, Compaq urges you to periodically review your system
  management and security procedures.  Compaq will continue to
  review and enhance the security features of its products and work
  with customers to maintain and improve the security and integrity
  of their systems.


 (c) Copyright 2001 Compaq Computer Corporation.  All rights reserved


-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBOpqHKKgxZJFjvD74EQJUwgCfXJEYoYSJYYxrKNmbpX7bBDNMiqsAnjaL
LfJteqxeY7s9leizezXY2izU
=pKLH
-----END PGP SIGNATURE-----