Title       : Buffer overflows in X11/Motif libraries
Date        : 970910
Type        : SB
Document ID : HPSBUX9707-067



-------------------------------------------------------------------------
**REVISED 01** HEWLETT-PACKARD SECURITY BULLETIN: #00067, 30 July 1997
Last Revised: 08 September 1997
-------------------------------------------------------------------------

 The information in the following Security Bulletin should be acted upon
 as soon as possible.  Hewlett Packard will not be liable for any
 consequences to any customer resulting from customer's failure to fully
 implement instructions in this Security Bulletin as soon as possible.

-------------------------------------------------------------------------
PROBLEM:  Buffer overflows in X11/Motif libraries.

PLATFORM: HP9000 Series 700/800 running releases 9.X and 10.X

DAMAGE:   Suid/sgid programs linked with X11/Motif libraries can
          be exploited to increase privileges.

SOLUTION: Install the patches listed below.  Any programs that are
          linked archived with any previous versions of the X11/Motif
          libraries must be relinked with the libraries in the patches.

AVAILABILITY:  The patches are available now.

CHANGE SUMMARY:  Added patches for HP-UX 10.24.
-------------------------------------------------------------------------
I.
   A. Background - Several buffer overflow conditions have been
                   identified.  These have been present in all
                   previous versions of the X11/Motif libraries.

   B. Fixing the problem - Install the applicable patches:
      **REVISED 01**

      PHSS_11626         9.X X11R5/Motif1.2  Runtime
      PHSS_11627         9.X X11R5/Motif1.2  Development

      PHSS_11043       10.0X X11R5/Motif1.2  Runtime (also for 10.10)
      PHSS_11044       10.0X X11R5/Motif1.2  Development

      PHSS_11043       10.10 X11R5/Motif1.2  Runtime (also for 10.0X)
      PHSS_11045       10.10 X11R5/Motif1.2  Development

      PHSS_11628       10.20 X11R5/Motif1.2  Runtime
      PHSS_11629       10.20 X11R5/Motif1.2  Development

      PHSS_11628       10.20 X11R6/Motif1.2  Runtime
      PHSS_11630       10.20 X11R6/Motif1.2  Development

  -->>PHSS_11021       10.24 VVOS X/Motif Runtime July97 Periodic patch

      PHSS_9858          9.X VUE 3.0

      PHSS_9804        10.01 VUE 3.0

      PHSS_9805        10.10/10.20 VUE 3.0

      PHSS_11373         9.X JSE A.B9.40

      Then relink any suid/sgid programs that use X11 or Motif archived
      libraries.

   C. Recommended solution - Install the applicable patches and
      relink archived suid/sgid programs.

   D. Impact of the patch - The fixes are in the X11/Motif patches.
      The VUE and JSE patches make use of the libraries in the
      X11/Motif patches.

   E. To subscribe to automatically receive future NEW HP Security
      Bulletins from the HP Electronic Support Center via electronic
      mail, do the following:

      User your browser to get to the HP Electronic Support Center page
      at:

      http://us-support.external.hp.com
      (for US, Canada, Asia-Pacific, & Latin-America)

      http://europe-support.external.hp.com
      (for Europe)

      Click on the Technical Knowledge Database, register as a user
      (remember to save the User ID assigned to you, and your password),
      and it will connect to a HP Search Technical Knowledge DB page.
      Near the bottom is a hyperlink to our Security Bulletin archive.
      Once in the archive there is another link to our current
      security patch matrix. Updated daily, this matrix is categorized
      by platform/OS release, and by bulletin topic.

   F. To report new security vulnerabilities, send email to

          security-alert@hp.com


      Please encrypt any exploit information using the security-alert
      PGP key, available from your local key server, or by sending a
      message with a -subject- (not body) of 'get key' (no quotes) to
      security-alert@hp.com.

     Permission is granted for copying and circulating this Bulletin to
     Hewlett-Packard (HP) customers (or the Internet community) for the
     purpose of alerting them to problems, if and only if, the Bulletin
     is not edited or changed in any way, is attributed to HP, and
     provided such reproduction and/or distribution is performed for
     non-commercial purposes.

     Any other use of this information is prohibited. HP is not liable
     for any misuse of this information by any third party.
________________________________________________________________________