From: bkelley@ef2007.efhd.ford.com (Brian Kelley)
Newsgroups: comp.sys.hp,alt.security
Subject: Re: HP finally has released ypbind with security fixes!
Date: 13 Oct 1992 16:04:57 -0400
Organization: EFHD, Ford Motor Company
Distribution: world
NNTP-Posting-Host: ef2007.efhd.ford.com

In article <3872@ra.nrl.navy.mil> atkinson@itd.nrl.navy.mil (Randall Atkinson) writes:
>In article <STEINAR.HAUG.92Oct7094355@delab.sintef.no> Steinar.Haug@delab.sintef.no (Steinar Haug) writes:
>>HP finally has released ypbind with security fixes, as the CERT Advisory
>>reproduced below shows. Thanks, HP! (And about time!)

FWIW, the patches have been available since June 23, when I first called
CERT.  This was the first time I have dealt directly with CERT.  My
impressions?  Well, they care.  However, advisories are few and far between.

Your advisory may be delayed while someone goes on vacation or to a
conference.  A huge amount of phone tag was played between HP and CERT.
I feel advisories are taking a back seat to politics.  Post the advisories,
and the fixes will come.  CERT seems to wait for the vendor to do a lot of
jumping, even when the patches are available.  The vendor may eventually
do everything CERT requests, but it may be monthes or years down the
road.  The whole advisory process reeks of a "Media Event" where marketing
seems to play far too great a role.  You heard right, Marketing.. Jeez...

>>Now, how about making
>>such security fixes available on the net (for instance from ftp.uu.net), like
>>other vendors do?
>
>  Absolutely right.  Security-relevant patches should be available via
>anonymous ftp from a well connected site as soon as they are created.
>Other vendors, for example Sun, have been doing that for years.  HP is
>really behind the times and needs to open up.

Ahem... Did you guys actually read the CERT?  I know it was long, but the
patches are available via ftp.  Granted, they are available from a HP
machine and not some other less controlled site, but they are definitely
available.  You must register for the access, it isn't anonymous.  I don't
feel that is a big deal, and it is free.

If you read closely, the CERT identifies 3 types of customers:

> 1) Eligible HP SupportLine customers (who have a software support
>    contract or have recently purchased an HP 9000) who access via a
>    terminal or modem.
> 2) Eligible HP SupportLine customers who would access via Internet.
                                                            ^^^^^^^^
> 3) Customers not currently accessing HP SupportLine.

The CERT goes on to document how each can access the patches.  There was 
a slight error for group 3 customers.  The CERT only specified phone 
access.  In my testing as a group 3 customer, I could also get the patches
via ftp.

Technically, I believe anyone with an HP workstation will probably need 
"BasicLine" support in order to run the latest OS rev. legally.  That
basic level of support includes updates, and Hotline and patch access.  One
of the good things to come out of this CERT bulletin was for HP to allow
non-support customers access to security related patches (as Sun has done
for a long time and IBM has recently begun to do).


  Brian


--
bkelley@pms001.pms.ford.com
Certainly not speaking for FORD.




Newsgroups: comp.sys.hp