HPSBUX02115 SSRT061077 rev.2 - HP-UX running Support Tools Manager (xstm, cstm, stm) Local Denial of Service (DoS) - c00657001

Hewlett-Packard Company has become aware of a potential vulnerability in the Support Tool Manager (STM) application, typically used for hardware diagnostic purposes.
To determine if an HP-UX system has an affected version, search the output of "swlist -a revision -l fileset" for one of the filesets listed below. For affected systems verify that the recommended action has been taken.

AFFECTED VERSIONS
HP-UX B.11.11
==========
->Sup-Tool-Mgr.STM-SHLIBS,revision=B.11.11.13.14
->Sup-Tool-Mgr.STM-SHLIBS,revision=B.11.11.14.15
->Sup-Tool-Mgr.STM-SHLIBS,revision=B.11.11.15.13
->action: install revision B.11.11.17.02 or subsequent
URL: http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6191AAE

HP-UX B.11.11
==========
->Sup-Tool-Mgr.STM-SHLIBS,revision=B.11.11.16.09
action: install PHSS_34288 or subsequent

HP-UX B.11.23
==========
Sup-Tool-Mgr.STM-SHLIBS
action: install revision B.11.23.07.04 or subsequent
URL: http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6191AAE

END AFFECTED VERSIONS

RESOLUTION

HP is providing the following to resolve this potential vulnerability.
->HP-UX B.11.11
============

STM Version	Distribution	SW Depot ID	Resolution
A.43.00	HWE0312	B.11.11.13.14	Install revision B.11.11.17.02 or subsequent
A.45.00	HWE0406	B.11.11.14.15	Install revision B.11.11.17.02 or subsequent
A.47.00	HWE0412	B.11.11.15.13	Install revision B.11.11.17.02 or subsequent
A.49.10	HWE0509	B.11.11.16.09	Install PHSS_34288 or subsequent

->PHSS_34288 can be downloaded from http://itrc.hp.com
->Revision B.11.11.17.02 (STM version A.52.00, HWE0606) is available here:
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6191AAE

->NOTE:
->Customers running STM version A.49.10 (revision B.11.11.16.09) can either install
->PHSS_34288 or install STM version A.52.00 (revision B.11.11.17.02) or subsequent.
->Customers running STM versions prior to version A.49.10 (revision B.11.11.16.09) must
->install STM version A.52.00 (revision B.11.11.17.02) or subsequent to resolve the issue.

HP-UX B.11.23
==========
For HP-UX B.11.23 running STM versions prior to C.53.00 (revision B.11.23.07.04)
Install STM version C.53.00 or subsequent

The update is available here:
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6191AAE
->For further information please refer to http://docs.hp.com/en/diag/stm/stm_upd.htm

MANUAL ACTIONS: Yes - Update

->HP-UX B.11.11 update to B.11.11.17.02, STM versions A.52.00 or subsequent
HP-UX B.11.23 update to B.11.23.07.04, STM version: C.53.00 or subsequent

PRODUCT SPECIFIC INFORMATION
HP-UX Security Patch Check: Security Patch Check revision B.02.00 analyzes all HP-issued Security Bulletins to provide a subset of recommended actions that potentially affect a specific HP-UX system. For more information: http://software.hp.com/portal/swdepot/displayProductInfo.do? productNumber=B6834AA

HISTORY:
Version: 1 (rev.1) 14 June 2006 Initial release
Version: 2 (rev.2) 15 August 2006 clarified B.11.11 resolution

Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.

HP Support document

Business Support Center

HP Passport Sign-in

Tasks

Resources