PASS TO SITE/FACILITY/COMMAND INFORMATION SYSTEM SECURITY OFFICE
{ISSO}, SPECIAL SECURITY OFFICER {SSO}, INFORMATION RESOURCE
MANAGER {IRM} AND AUTOMATED DATA PROCESSOR {ADP} COORDINATORS
U-1,290/DS-SIM {DCPO}
SUBJ:  IMPROVING SECURITY ON UNICOS SYSTEMS {AUTOMATED SYSTEMS
SECURITY INCIDENT SUPPORT TEAM {ASSIST} 92-51}
1.  DISCUSSION:  THE PATCHES DESCRIBED IN THIS MESSAGE HAVE BEEN
IDENTIFIED BY CRAY RESEARCH CORPORATION AND CRAY USERS AS
IMPORTANT IN ASSURING A BASELINE LEVEL OF SECURITY IS INSTALLED ON
UNICOS SYSTEMS.  SOME OF THESE PATCHES HAVE BEEN THE SUBJECT OF
CRAY ALERT BULLETINS {CRAY FIELD ALERT}, EACH OF WHICH WILL BE
REFERENCED AS EACH PATCH IS IDENTIFIED.  YOU MAY CONTACT CRAY FOR
ADDITIONAL INFORMATION IN OBTAINING, INSTALLING AND VERIFYING THAT
THESE PATCHES HAVE BEEN INSTALLED ON YOUR UNICOS SYSTEM.  THE MODS
LISTED BELOW ARE CRAY BINARY FILES AVAILABLE TO CORRECT EACH
DESCRIBED PROBLEM.  THESE MODS ARE AVAILABLE ON THE CRAYAMID
SYSTEM.  EACH UNICOS MOD HAS A UNIQUE IDENTIFICATION.  FOR 
EXAMPLE, CRAY MOD D15567CMDA IS APPROPRIATE TO SPECIFIC VERSIONS
OF THE UNICOS OPERATING SYSTEM.  UNLESS OTHERWISE STATED, THE MOD
WILL APPLY TO THE ENTIRE FAMILY OF CRAY HARDWARE, INCLUDING CRAY-
1, X-MP, Y-MP, AND CRAY-2.
2.  A.  CRAY MOD D15567CMDA, UNICOS VERSION 5.0/5.1.  MODIFIES THE
COMMAND /BIN/DU.  ALTERNATIVELY, REMOVING THE SETUID BIT FROM THE
/BIN/DU COMMAND BY EXECUTING THE FOLLOWING COMMAND AS ROOT WILL
EFFECTIVELY REPLACE THE NEED FOR THE ABOVE MOD: CHMOD 0755
/BIN/DU.
B.  CRAY MOD D18028, UNICOS VERSION 5.0/5.1.  MODIFIES THE COMMAND
/ETC/NU.  THIS MOD HAS BEEN INTEGRATED IN THE BASELINE OPERATING
SYSTEM FOR CRAY-1/XMP/YMP AT VERSION 5.1.8D AND VERSION 5.1.8 FOR
CRAY-2.  FOR MORE DETAILS, SEE CRAY FIELD ALERT NO. 93.
C.  CRAY MOD E13159UTSA, UNICOS VERSION 4.0, 4.EA, 5.0.  THIS
PATCH WAS THE SUBJECT OF CRAY FIELD ALERT NO. 72.  THE PATCH
MODIFIES THE READ/WRITE AND READA/WRITEA SYSTEM CALLS.  A COPY OF
THE MOD MAY BE FOUND ON THE CRAYAMID SYSTEM UNDER
/U/MODS/UNICOS{UNDERSCORE SIGN}X/5.0/UTS/E13159UTSA.
D.  LIMITED BUFFER SPACE IN THE KERNEL FOR SOME ENTRIES.  THIS
PROBLEM CAN BE CORRECTED WITH THE FOLLOWING MODS THAT ARE 
APPROPRIATE FOR YOUR SYSTEM.
UNICOS 5.1:  XMPD19646UTSA
             CRAY-2     D19647INCA
             XMP, CRAY-2D19648TCPA 
UNICOS 6.0:  XMP60UTS07182A
             XMP60UTS07187A
             XMP, CRAY-260UTS07186A
             CRAY-2     60UTS07184A
UNICOS 6.1:  XMP61UTS07182A
             XMP61UTS07187A
             XMP,CRAY-261UTS07186A
             CRAY-2     61UTS07184A
3.  RECOMMENDATION:  ASSIST RECOMMENDS THAT YOU INSTALL ANY OF THE
MODS LISTED ABOVE THAT ARE APPROPRIATE TO YOUR UNICOS SYSTEM.  IN
ADDITION, YOU SHOULD UPGRADE YOUR VERSION OF UNICOS TO THE MOST
RECENT AVAILABLE.  IMPROVEMENTS IN THE SECURITY BASELINE OF UNICOS
HAVE BEEN INTEGRATED INTO THE MOST RECENT VERSION OF THE OPERATING
SYSTEM.
4.  POINT OF CONTACT:  ASSIST POINT OF CONTACT FOR THIS MATTER IS
MIKE HIGGINS, COMM {202} 373-8852/55 OR DSN 243-8852/55.  ASSIST 
CAN BE REACHED 24 HOURS PER DAY, COMMERCIAL PAGER {800} SKY-PAGE,
PIN NUMBER 2133937 {FROM A TOUCH TONE PHONE ENTER THE CALL BACK
NUMBER AFTER THE PROMPT} OR AUTOVON DIAL 243-8000 AND ASK TO HAVE
THE ASSIST DUTY OFFICER PAGED.  ASSIST CAN BE REACHED VIA E-MAIL
AT "DOD-CERT{AT-SIGN}DDN-CONUS.DDN.MIL."