----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
HP TCP/IP Services for OpenVMS Two Security Issues

SECUNIA ADVISORY ID:
SA25882

VERIFY ADVISORY:
http://secunia.com/advisories/25882/

CRITICAL:
Less critical

IMPACT:
Brute force, Exposure of sensitive information

WHERE:
>From local network

SOFTWARE:
HP TCP/IP Services for OpenVMS 5.x
http://secunia.com/product/2949/

DESCRIPTION:
Two security issues have been reported in HP TCP/IP Services for
OpenVMS, which can be exploited by malicious people to disclose
sensitive information or to conduct brute force attacks.

1) The security issue is caused due to the POP server returning
different responses depending on whether or not a valid user name is
supplied and can be exploited to enumerate valid POP user names.

2) The problem is that the TCP/IP Services POP3 mail mechanism is not
utilising the intrusion detection of OpenVMS properly. This can be
exploited to conduct brute force attacks.

The security issues are reported in TCP/IP Services 5.6. Other
versions may also be affected.

SOLUTION:
Grant only trusted people network access to the POP service.

PROVIDED AND/OR DISCOVERED BY:
JF Mezei

ORIGINAL ADVISORY:
http://groups.google.com/group/comp.os.vms/browse_thread/thread/a5f68773805f862d/8a42e91fe1e9cd36

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------