Jump to content
HP Support Center
Content starts here
View Download options menu View Knowledge Base menu View Parts, Repair & Warranty menu View Get help from HP menu

HP Support document

Rate this content

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03762155

Version: 1

HPSBNS02880 rev.1 - HP NonStop Servers running SQL/MX using SQL/MP Objects, Remote Unauthorized Disclosure of Information and Data Modification
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2013-06-24

Last Updated: 2013-06-24


Potential Security Impact: Remote unauthorized disclosure of information, data modification

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY

Two potential vulnerabilities have been identified with HP NonStop Servers running SQL/MX using SQL/MP Objects. The first vulnerability, SQL/MP index, could be remotely exploited by an authenticated user resulting in disclosure of information. The second vulnerability, SQL/MP tables, could be remotely exploited by an authenticated user to bypass security restrictions resulting in unauthorized data modification.

References: CVE-2013-2322 (SQL/MP index), CVE-2013-2323 (SQL/MP tables), SSRT101037

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

SQL/MP index (CVE-2013-2322) impacts HP NonStop SQL/MX release 3.2 and earlier.

SQL/MP tables (CVE-2013-2323) impacts HP NonStop SQL/MX releases 3.0, 3.1 and 3.2 only.

Note: For Release Version Updates (RVUs) J06.11/H06.22 through J06.13/H06.24, the version of SQL/MX shipped on Site Update Tapes (SUTs) was 2.3.x.
Beginning with J06.14/H06.25, the version of SQL/MX shipped on SUTs was 3.x.

Affected Software Product Revisions (SPRs):

SQL/MX 3.x versions (both vulnerabilities)

SQL/MP index vulnerability:

T1050 SQL/MX MXCMP SPRs:

T1050H32
T1050H31^APK
T1050H31^AOW
T1050H31^AON
T1050H31
T1050H30^AOX
T1050H30^ANW
T1050H30
 
 
 
 

Release Version Updates containing the defective SPRs:

J06.14
J06.14.01
H06.25
 
 

Additional Release Version Updates potentially affected because one or more of the defective SPRs is usable with them:

J06.11
J06.11.01
J06.12
J06.13
J06.13.01
J06.15
 
 
 
 
 
 
 
 
H06.22
H06.22.01
H06.23
H06.24
H06.24.01
H06.26
 
 
 
 
 
 
 
 

SQL/MP tables vulnerability:

T1051 SQL/MX EXE SPRs:

T1051H32
T1050H31^APO
T1051H31^AON
T1051H31
T1051H31
T1051H30^ANW
T1051H30
     

Release Version Updates containing the defective SPRs:

J06.14
J06.14.01
H06.25
 
 

Additional Release Version Updates potentially affected because one or more of the defective SPRs are usable with them:

J06.11
J06.11.01
J06.12
J06.13
J06.13.01
J06.15
 
 
 
 
 
 
 
 
H06.22
H06.22.01
H06.23
H06.24
H06.24.01
H06.26
 
 
 
 
 
 
 
 

SQL/MX 2.3.x versions: (SQL/MP index vulnerability)

T1050 SQL/MX MXCMP SPRs:

T1050H23
T1050H23^AEQ
T1050H23^AFJ
T1050H23^AFV
T1050H23^AGF
T1050H23^AHN
T1050H23^AHY
T1050H23^AIE
T1050H23^AIF
T1050H23^AIV
T1050H23^AJB
T1050H23^AJD
T1050H23^AJG
T1050H23^AJM
T1050H23^AJT
T1050H23^AKD
T1050H23^AKL
T1050H23^AKN
T1050H23^ALK
T1050H23^ANC
T1050H23^AND
T1050H23^ANF
T1050H23^ANG
T1050H23^ANJ
T1050H23^ANK
T1050H23^ANL
T1050H23^ANO
T1050H23^ANR
T1050H23^ANS
T1050H23^ANZ
T1050H23^AOA
T1050H23^AOG
T1050H23^AOH
T1050H23^AOK
T1050H23^AOQ
T1050H23^AOU
T1050H23^AOZ
T1050H23^APJ
 
 
 
 

Release Version Updates containing the defective SPRs:

J06.03
J06.04
J06.04.01
J06.04.02
J06.05
J06.05.01
J06.05.02
J06.06
J06.06.01
J06.06.02
J06.06.03
J06.07
J06.07.01
J06.07.02
J06.08
J06.08.01
J06.08.02
J06.08.03
J06.08.04
J06.09
J06.09.01
J06.09.02
J06.09.03
J06.09.04
J06.10
J06.10.01
J06.10.02
J06.11
J06.11.01
J06.12
J06.13
J06.13.01
 
 
 
 
 
 
H06.10
H06.10.01
H06.11
H06.11.01
H06.11.02
H06.11.03
H06.12
H06.13
H06.14
H06.15
H06.15.01
H06.15.02
H06.16
H06.16.01
H06.16.02
H06.17
H06.17.01
H06.17.02
H06.17.03
H06.18
H06.18.01
H06.18.02
H06.19
H06.19.01
H06.19.02
H06.19.03
H06.20
H06.20.01
H06.20.02
H06.20.03
H06.21
H06.21.01
H06.21.02
H06.22
H06.22.01
H06.23
H06.24
H06.24.01
 
 
 
 

SQL/MX 1.8, 2.0, 2.1 and 2.2 versions: (SQL/MP index vulnerability)

T1050 SQL/MX MXCMP SPRs:

T1050H22^ACF
T1050H22^ACO
T1050H22^ACX
T1050H22^ACY
T1050H22^ADJ
T1050H22^ADL
T1050H22^ADO
T1050H22^ADW
T1050H22^AEF
T1050H22^AEI
T1050H22^AEM
T1050H22^AEZ
T1050H22^AFR
T1050H22^AGH
T1050H22^AGY
T1050H22^AHD
T1050H22^AID
T1050H22^AJE
T1050H22^ALI
 
 
T1050G08^AAI
T1050G08^AAJ
T1050G08^AAM
T1050G08^AAP
T1050G08^AAR
T1050G08^AAV
T1050G08^AAX
T1050G08^ABC
T1050G08^ABI
T1050G08^ABK
T1050G08^ABS
T1050G08^ABW
T1050G08^ABZ
T1050G08^ACQ
T1050G08^ACW
T1050G10^ABA
T1050G10^ABJ
T1050G10^ABL
T1050G10^ABQ
T1050G10^ACB
T1050G10^AES
T1050G21^ABU
T1050G21^ABX
T1050G21^ACC
T1050G21^ACH
T1050G21^ACM
T1050G21^ACN
T1050G21^ADT
T1050G21^ADV
T1050G21^AEL
T1050G21^AEO
T1050G21^AHC
T1050G21^ALA
 
 
 
 

Release Version Updates containing the defective SPRs:

H06.03.00
H06.03.01
H06.04.00
H06.05.00
H06.05.01
H06.05.02
H06.06.00
H06.07.00
H06.07.01
H06.08.00
H06.09.00
 
 
 
 
 
 
 
 
G06.18
G06.19
G06.20
G06.21
G06.22
G06.23
G06.24
G06.25
G06.26
G06.27
G06.28
G06.29
G06.29.01
G06.29.02
G06.29.03
G06.30
G06.30.01
G06.30.02
G06.31
G06.31.01
G06.32
G06.32.01
 
 
 
 
 
 
l

BACKGROUND

For a PGP signed version of this security bulletin please write to: security-alert@hp.com

CVSS 2.0 Base Metrics
Reference
Base Vector
Base Score
CVE-2013-2322
(AV:N/AC:M/Au:S/C:P/I:N/A:N)
3.5
CVE-2013-2323
(AV:N/AC:H/Au:S/C:P/I:P/A:P)
4.6
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002

RESOLUTION

HP has made the following software updates available to resolve the vulnerabilities.

RVUs containing final fix (both vulnerabilities):

SQL/MX 3.2.1
J06.14.02
J06.15
H06.25.01
H06.26
SQL/MX 3.2
None
SQL/MX 3.1
None
SQL/MX 3.0
No fix for either vulnerability is planned
SQL/MX 2.1 and 2.2
No fix for the SQL/MP index vulnerability is planned
G-Series
No fix for the SQL/MP index vulnerability is planned

Fix (SQL/MP index vulnerability):

Install the appropriate SPRs for T1050 SQL/MX MXCMP as shown below, depending on your release version.

SQL/MX R3.2: T1050H32 APW – already available

This SPR already is present in these RVUs: None

This SPR is usable with the following RVUs:

J06.14
J06.14.01
J06.15
H06.25
H06.26
 
 

SQL/MX R3.1: T1050H31 APV – already available

This SPR already is present in these RVUs: None

This SPR is usable with the following RVUs:

J06.12
J06.13
J06.13.01
J06.14
J06.14.01
J06.15
H06.23
H06.24
H06.24.01
H06.25
H06.26
 
 

SQL/MX R2.3: T1050H23 APN – already available

This SPR already is present in these RVUs: None

This SPR is usable with the following RVUs:

J06.03
J06.04
J06.04.01
J06.04.02
J06.05
J06.05.01
J06.05.02
J06.06
J06.06.01
J06.06.02
J06.06.03
J06.07
J06.07.01
J06.07.02
J06.08
J06.08.01
J06.08.02
J06.08.03
J06.08.04
J06.09
J06.09.01
J06.09.02
J06.09.03
J06.09.04
J06.10
J06.10.01
J06.10.02
J06.11
J06.11.01
J06.12
J06.13
J06.13.01
J06.14
J06.15
 
 
H06.14
H06.15
H06.15.01
H06.15.02
H06.16
H06.16.01
H06.16.02
H06.17
H06.17.01
H06.17.02
H06.17.03
H06.18
H06.18.01
H06.18.02
H06.19
H06.19.01
H06.19.02
H06.19.03
H06.20
H06.20.01
H06.20.02
H06.20.03
H06.21
H06.21.01
H06.21.02
H06.22
H06.22.01
H06.23
H06.24
H06.24.01
H06.25
H06.26
 
 
 
 
 
 

Fix (SQL/MP tables vulnerability)

Install the appropriate SPRs for T1051 SQL/MX EXE as shown below, depending on your release version.

SQL/MX R3.2: T1051H32 APW – already available

This SPR already is present in these RVUs:

J06.14.02
H06.25.01

This SPR is usable with the following RVUs:

J06.14
J06.14.01
J06.15
H06.25
H06.26
 
 

SQL/MX R3.1: T1051H31 APL – already available

This SPR already is present in these RVUs: None

This SPR also is usable with the following RVUs:

J06.12
J06.13
J06.13.01
J06.14
J06.15
H06.23
H06.24
H06.24.01
H06.25
H06.26

You can check with the GNSC for applicability of this SPR to RVURs released since publication of this security bulletin.

Installation impact: If the T1051 fix is applied, SYSGEN is required. This applies to the SQL/MP tables vulnerability.

If the T1050 fix is applied, applications need to be recompiled after SPR installation in order to avoid the problem described. This applies to the SQL/MP index vulnerability.

Please refer to the appropriate softdoc(s) for detailed SPR information, including installation instructions, superseded SPRs, and requisite SPR lists. Note that in some cases, requisite SPRs might have greater installation impact than the SPRs described in this security bulletin.

HISTORY
Version:1 (rev.1) - 24 June 2013 Initial release

Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.

Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.

Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com

Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins

Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive

Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.

3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX

©Copyright 2013 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.