Updated: December 11, 2001
Status
Affected
Vendor Statement
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
*** NO RESTRICTIONS FOR DISTRIBUTION ***
=======================================================
SOURCE: Compaq Computer Corporation SSRT0708U
Software Security Response Team
TITLE: Potential denial of Service in inetd Tru64 V5.1 Only
(Compaq Case ID: SSRT0708U)
Date: 23-FEB-2000
"Compaq is broadly distributing this Security Advisory in order
to bring to the attention of users of Compaq products the
important security information contained in this Advisory.
Compaq recommends that all users determine the applicability of
this information to their individual situations and take
appropriate action.
Compaq does not warrant that this information is necessarily
accurate or complete for all user situations and, consequently,
Compaq will not be responsible for any damages resulting from
user's use or disregard of the information provided in this
Advisory."
IMPACT:
Versions Affected:
Compaq's Tru64 UNIX V5.1 ONLY (all patch levels)
A potential security vulnerability has been discovered for
Tru64 UNIX V5.1, where under certain circumstances, there
is a problem with the inetd Internet services daemon that can
cause it to stop accepting connections. This causes all
services handled by inetd to be inaccessible including ftp,
telnet, rsh, rlogin, rexec, pop3, imap, radius, etc..
SEVERITY: Medium
PROBLEM STATEMENT:
This problem exists in Tru64 UNIX 5.1 inetd only. The
/usr/sbin/inetd is the master daemon for many services.
The inetd may stop responding to requests if one of its
services cores as it is being started. Inetd continues to run.
The netstat -An command may indicate many outstanding
connections to the same PCB.
If you are installing Open Source Internet Solutions on Tru64 UNIX
Version 5.1, it is strongly urged that you install this patch kit.
If you are installing Open Source Internet Solutions
on a Tru64 UNIX Version 5.1 TruCluster system, you must
install this patch kit prior to installing Open Source
Internet Solutions because without it inetd failure during
this procedure will cause an installation failure since it will
interfere with intra-cluster communications.
SOLUTION:
Compaq Tru64 UNIX engineering has provided a fix for this potential
problem for Tru64 UNIX V5.1
We apologize that this fix is not available from our patch site. If
you determine that you need this fix please contact your
normal Compaq Services support channel and request a
patch using the reference SSRT0708U.
This solution will be included in future releases of Tru64 UNIX
V5.1 aggregate patch kits.
To subscribe to automatically receive future NEW Security
Advisories from the Software Security Response Team at
Compaq via electronic mail,
Use your browser to get to the
http://www.support.compaq.com/patches/mailing-list.shtml
and sign up. Select "Security and Individual Notices" for
immediate dispatch notifications.
Compaq appreciates your cooperation and patience. We regret any
inconvenience applying this information may cause.
As always, Compaq urges you to periodically review your system
management and security procedures. Compaq will continue to
review and enhance the security features of its products and work
with customers to maintain and improve the security and integrity
of their systems.
(c) Copyright 2001 Compaq Computer Corporation. All rights reserved
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
iQA/AwUBOpqEJagxZJFjvD74EQKJ0QCgufmzlfzBPtjKVHSG5E7nUygAjiAAoPjb
N9KxDqTZgk4ooTbHDo1dOem+
=egya
-----END PGP SIGNATURE-----
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.