FOR OFFICIAL DEPARTMENT OF ENERGY USE ONLY
========================================================================
||        THE COMPUTER INCIDENT ADVISORY CAPABILITY          ||
||                         ||  
||             C I A C              ||
||                      ||
||        INFORMATION NOTICE            ||
========================================================================
           
      HP-UX Trusted Systems 6.5 or 7.0, Authorization Problem
      -------------------------------------------------------

Oct 24, 1990 1600 PST            Number B-5

Summary::  Critical HP-UX Trusted Systems Facts 
- ----------------------------------------------------------------------------
PROBLEM:  May allow non-privileged users to gain root access.
PLATFORM:  Hewlett Packard, Trusted Systems 6.5/7.0
DAMAGE:    Allows unauthorized system modification.
WORKAROUND:  Ensure correct password files and use user names less than 8 
    characters.
PATCH:    H.P. is aware of this problem and has released patch P025, 
    available from the HP Response Center or your local HP
    representative.
SYSTEM IMPACT:  Inconvenience of temporarily changing some user names.
- ----------------------------------------------------------------------------

CIAC has learned of a serious security problem with Hewlett Packard
Trusted Systems 6.5/7.0, which may allow non-privileged users to gain
root access.  Two problems exist within the user authentication
(login) system.  Both problems only effect the secure C2 version of
HP-UX.  If you are running Trusted Systems 6.5 or 7.0, then the
vulnerability exists on your system.  The two related vulnerabilities
are:

Problem 1
If you are running Trusted Systems HP-UX you must be absolutely sure
that each entry in your /.secure/etc/passwd file matches an entry in
your /etc/passwd file.  If you have an entry in /.secure/etc/passwd,
and not in /etc/passwd, the user will be authorized and given root
privileges.

Problem 2
A related vulnerability has to do with users that have 8 character
user names.  If any users have user names of 8 characters, you should
change them to 7 or less characters until you install the patch
described below.

Solution
The above modifications should be considered a temporary workaround.
A permanent solution to both, is to obtain patch P025 from the HP
Response Center, or your local HP Representative.

For additional information or assistance, please contact CIAC, or your
local HP Representative.

  David Brown
  (415) 423-9878 or (FTS) 543-9878

  FAX:  (415) 423-0913 or (FTS) 543-0913 
 
or send e-mail to:

  ciac@tiger.llnl.gov

Neither the United States Government nor the University of California
nor any of their employees, makes any warranty, expressed or implied,
or assumes any legal liability or responsibility for the accuracy,
completeness, or usefulness of any information, product, or process
disclosed, or represents that its use would not infringe privately
owned rights.  Reference herein to any specific commercial products,
process, or service by trade name, trademark manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation, or favoring by the United States Government or the
University of California.  The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government nor the University of California, and shall not be used for
advertising or product endorsement purposes.