Updated:  December 11, 2001

Status

Affected

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 *** NO RESTRICTIONS FOR DISTRIBUTION *** SOURCE: Compaq Computer Corporation SSRT0708U Software Security Response Team TITLE: Potential denial of Service in inetd Tru64 V5.1 Only (Compaq Case ID: SSRT0708U) Date: 23-FEB-2000 "Compaq is broadly distributing this Security Advisory in order to bring to the attention of users of Compaq products the important security information contained in this Advisory. Compaq recommends that all users determine the applicability of this information to their individual situations and take appropriate action. Compaq does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, Compaq will not be responsible for any damages resulting from user's use or disregard of the information provided in this Advisory." IMPACT: Versions Affected: Compaq's Tru64 UNIX V5.1 ONLY (all patch levels) A potential security vulnerability has been discovered for Tru64 UNIX V5.1, where under certain circumstances, there is a problem with the inetd Internet services daemon that can cause it to stop accepting connections. This causes all services handled by inetd to be inaccessible including ftp, telnet, rsh, rlogin, rexec, pop3, imap, radius, etc.. SEVERITY: Medium PROBLEM STATEMENT: This problem exists in Tru64 UNIX 5.1 inetd only. The /usr/sbin/inetd is the master daemon for many services. The inetd may stop responding to requests if one of its services cores as it is being started. Inetd continues to run. The netstat -An command may indicate many outstanding connections to the same PCB. If you are installing Open Source Internet Solutions on Tru64 UNIX Version 5.1, it is strongly urged that you install this patch kit. If you are installing Open Source Internet Solutions on a Tru64 UNIX Version 5.1 TruCluster system, you must install this patch kit prior to installing Open Source Internet Solutions because without it inetd failure during this procedure will cause an installation failure since it will interfere with intra-cluster communications. SOLUTION: Compaq Tru64 UNIX engineering has provided a fix for this potential problem for Tru64 UNIX V5.1 We apologize that this fix is not available from our patch site. If you determine that you need this fix please contact your normal Compaq Services support channel and request a patch using the reference SSRT0708U. This solution will be included in future releases of Tru64 UNIX V5.1 aggregate patch kits. To subscribe to automatically receive future NEW Security Advisories from the Software Security Response Team at Compaq via electronic mail, Use your browser to get to the http://www.support.compaq.com/patches/mailing-list.shtml and sign up. Select "Security and Individual Notices" for immediate dispatch notifications. Compaq appreciates your cooperation and patience. We regret any inconvenience applying this information may cause. As always, Compaq urges you to periodically review your system management and security procedures. Compaq will continue to review and enhance the security features of its products and work with customers to maintain and improve the security and integrity of their systems. (c) Copyright 2001 Compaq Computer Corporation. All rights reserved -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use iQA/AwUBOpqEJagxZJFjvD74EQKJ0QCgufmzlfzBPtjKVHSG5E7nUygAjiAAoPjb N9KxDqTZgk4ooTbHDo1dOem+ =egya -----END PGP SIGNATURE-----

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.