Title       : Security vulnerability in `at' & `cron'
Date        : 970613
Type        : SB
Document ID : HPSBUX9502-023

--------------------------------------------------------------------------------

-------------------------------------------------------------------------
**REVISED 01**HEWLETT-PACKARD SECURITY BULLETIN: #00023, 22 Feb 95
LAST CHANGE 12 June 1997
-------------------------------------------------------------------------

The information in the following Security Bulletin should be acted upon as
soon as possible. Hewlett- Packard will not be liable for any consequences
to any customer resulting from customer's failure to fully implement
instructions in this Security Bulletin as soon as possible.

_______________________________________________________________________

PROBLEM:  Security vulnerability in `at' and `cron' commands in HP-UX

PLATFORM: HP 9000 series 300/400s and/or 700/800s

DAMAGE:   Users can gain unauthorized privileges

SOLUTION: Apply patch:
                   PHCO_5203 (series 700    , HP-UX 8.X), or
                   PHCO_5204 (series 800    , HP-UX 8.X), or
                   PHCO_5199 (series 300/400, HP-UX 8.X), or
                   PHCO_5178 (series 700    , HP-UX 9.X), or
                   PHCO_5193 (series 800    , HP-UX 9.X), or
                   PHCO_5206 (series 300/400, HP-UX 9.0), or
                   PHCO_5206 (series 300/400, HP-UX 9.03),
**REVISED01** |    PHCO_5442 and PHCO_5414 (series 800, HP-UX 9.08), or
              |    PHCO_5416 and PHCO_5295 (series 700, HP-UX 9.09), or
              |    PHCO_5415 and PHCO_5295 (series 700, HP-UX 9.09+).

AVAILABILITY:   All patches are available now.

CHANGE SUMMARY: New patches for CMW/BLS releases are included.
_______________________________________________________________________

I. Update

   A. It has been found that all HP-UX systems have this vulnerability.

   B. Fixing the problem

      The vulnerability can be eliminated from releases 8.X and 9.X of
      HP-UX by applying a patch.

      All customers concerned with the security of their HP-UX systems
      should apply the appropriate patch described above as soon as
      possible.

   C. How to Install the Patch (for HP-UX 8.X and 9.X)

     1. Determine which patch is appropriate for your hardware platform and
        operating system:

                   PHCO_5203 (series 700    , HP-UX 8.X), or
                   PHCO_5204 (series 800    , HP-UX 8.X), or
                   PHCO_5199 (series 300/400, HP-UX 8.X), or
                   PHCO_5178 (series 700    , HP-UX 9.X), or
                   PHCO_5193 (series 800    , HP-UX 9.X), or
                   PHCO_5206 (series 300/400, HP-UX 9.0), or
                   PHCO_5206 (series 300/400, HP-UX 9.03),or
**REVISED01** |    PHCO_5442 and PHCO_5414 (series 800, HP-UX 9.08), or
              |    PHCO_5416 and PHCO_5295 (series 700, HP-UX 9.09), or
              |    PHCO_5415 and PHCO_5295 (series 700, HP-UX 9.09+).



     2. Apply the patch to your HP-UX system.
        Examine /tmp/update.log for any relevant WARNINGs or ERRORs.  This
        can be done as follows:

        a.  At the shell prompt, type "tail -60 /tmp/update.log | more"
        b.  Page through the next three screens via the space bar, looking
            for WARNING or ERROR messages.


     3. Impact of the patch and workaround

        The patch for HP-UX releases 8.X and 9.X provides a new version of
        /etc/cron and /usr/bin/at which fixes the vulnerability.


   E.  To subscribe to automatically receive future NEW HP Security
       Bulletins from the HP Electronic Support Center via electronic
       mail, do the following:

       User your browser to get to the HP Electronic Support Center page
       at:   http://us-support.external.hp.com
             (for US, Canada, Asia-Pacific, & Latin-America)

             http://europe-support.external.hp.com
             (for Europe)


       Click on the Technical Knowledge Database, register as a user
       (remember to save the User ID assigned to you, and your password),
       and it will connect to a HP Search Technical Knowledge DB page.
       Near the bottom is a hyperlink to our Security Bulletin archive.
       Once in the archive there is another link to our current
       security patch matrix. Updated daily, this matrix is categorized
       by platform/OS release, and by bulletin topic.


   F.  To report new security vulnerabilities, send email to

          security-alert@hp.com

       Please encrypt any exploit information using the security-alert
       PGP key, available from your local key server, or by sending a
       message with a -subject- (not body) of 'get key' (no quotes) to
       security-alert@hp.com.


     Permission is granted for copying and circulating this Bulletin to
     Hewlett-Packard (HP) customers (or the Internet community) for the
     purpose of alerting them to problems, if and only if, the Bulletin
     is not edited or changed in any way, is attributed to HP, and
     provided such reproduction and/or distribution is performed for
     non-commercial purposes.

     Any other use of this information is prohibited. HP is not liable
     for any misuse of this information by any third party.
________________________________________________________________________