TITLE:  Security patch for Internet Express wu-ftpd 2.5.0 through 2.6.2 (SSRT3606)

Copyright (c) Hewlett-Packard Company 2003.  All rights reserved.


PRODUCT:    Internet Express [R] V5.1 through V6.1
SOURCE:     Hewlett-Packard Company

ECO INFORMATION:

ECO Name:  T64V51AB-IX6-WU-FTPD-262-SSRT3606
ECO Kit Approximate Size:  0.56MB
Kit Applies To:  HP Tru64 UNIX 5.0A and higher

ECO Kit CHECKSUMS:
/usr/bin/sum results:
45586    570

/usr/bin/cksum results:
2490603725 583680

MD5 results:
{md5results}

SHA1 results:
{sha1results}


ECO KIT SUMMARY:

A setld(8)-based, Early Release Patch kit exists for Internet Express versions
5.1 through 6.1 that contains solutions to the following problem(s):

The following potential security vulnerabilities have been identified or
reported in the Internet Express product on Tru64 UNIX that may result in
unauthorized Privileged Access or a Denial of Service (DoS). These potential
vulnerabilities may be in the form of Local and Remote security domain risks.
HP has corrected these potential vulnerabilities.

SSRT3606 Wu-ftpd FTP server contains remotely exploitable off-by-one bug.

The README document provides patch kit installation and removal instructions
and a summary of the patch. Please read the README document prior to
installing patch on your system.


INSTALLATION NOTES:

1) Install this kit with the setld(8) utility that is included in the Tru64
UNIX operating system.

2) The patch in this ERP kit does not have any file intersections with any
other ERP available at this time for this product version.

3) This ERP kit will NOT install over any Customer Specific Patches (CSPs)
which have file intersections with this ERP kit. Contact your normal
Service Provider for assistance if the installation of this ERP kit is
blocked by any of your installed CSPs.

4) This patch was released on 8/19/03.


INSTALLATION PREREQUISITES:

You must have installed the IAEFTPxxx subset (where xxx is the subset
version number) from Internet Express version V5.1 through V6.1 on HP
Tru64 UNIX 5.0A or higher prior to installing this Early Release Patch Kit.


INSTALLATION INSTRUCTIONS:

To determine if this patch kit is needed:

# su root
# /usr/local/bin/ftpd -V | grep Version
Version wu-2.6.2(1) Thu May 8 02:03:26 EDT 2003

If the version is 2.5.0 through 2.6.2 and the date displayed
in the version string is prior to Tue Aug 19 02:50:14 EDT 2003,
this patch is needed. To install this patch kit:

# su root
# tar xvf T64V51AB-IX6-WU-FTPD-262-SSRT3606.tar
# setld -l . IAEFTP612

To remove this patch kit:

# su root
# setld -d IAEFTP612


KNOWN PROBLEMS WITH THE PATCH KIT:

None.


RELEASE NOTES FOR T64V51AB-IX6-WU-FTPD-262-SSRT3606:

This fix is included in the latest update to wu-ftpd V2.6.2 will be shipped
with Internet Express V6.2, which is due to release in December 2003.

[R] UNIX is a registered trademark in the United States and other countries
licensed exclusively through X/Open Company Limited.

Copyright Hewlett-Packard Company 2003.  All Rights reserved.

This software is proprietary to and embodies the confidential technology
of Hewlett-Packard Company.  Possession, use, or copying of this
software and media is authorized only pursuant to a valid written license
from Hewlett-Packard or an authorized sublicensor.

This ECO has not been through an exhaustive field test process.
Due to the experimental stage of this ECO/workaround, Hewlett-Packard
makes no representations regarding its use or performance. The
customer shall have the sole responsibility for adequate protection
and back-up data used in conjunction with this ECO/workaround.