PASS TO SITE/FACILITY/COMMAND INFORMATION SYSTEM SECURITY OFFICER
(ISSO), SPECIAL SECURITY OFFICER (SSO), INFORMATION RESOURCE MANAGER
(IRM) AND AUTOMATED DATA PROCESSOR (ADP) COORDINATORS
SUBJECT: SUNOS/SOLARIS /USR/LIB/EXPRESERVE VULNERABILITY (AUTOMATED
SYSTEM SECURITY INCIDENT SUPPORT TEAM (ASSIST) BULLETIN 93-19).
1.  ASSIST HAS RECEIVED UPDATED PATCH INFORMATION CONCERNING A
VULNERABILITY IN /USR/LIB/EXPRESERVE IN SUN MICROSYSTEMS, INC. (SUN)
OPERATING SYSTEM (SUNOS).  THIS VULNERABILITY AFFECTS ALL SUN3 AND
SUN4 ARCHITECTURES AND SUPPORTED VERSIONS OF SUNOS INCLUDING 4.1,
4.1.1, 4.1.2, 4.1.3, SOLARIS 2.0 (SUNOS 5.0), SOLARIS 2.1 (SUNOS
5.1), AND SOLARIS 2.2 (SUNOS 5.2).  THE VULNERABILITY AND PATCH
INFORMATION IN THIS BULLETIN FOR SUNOS WAS PREVIOUSLY RELEASED IN
ASSIST 93-18, BUT THE SOLARIS PATCH INFORMATION IS NEW.  INFORMATION
ABOUT THIS PROBLEM HAS BEEN WIDELY DISTRIBUTED, AND ASSIST RECOMMENDS
THAT SITES TAKE ACTION TO ADDRESS THIS VULNERABILITY AS SOON AS
POSSIBLE.
2.  SUN HAS PRODUCED A PATCH FOR SUNOS 4.1, 4.1.1, 4.1.2, AND 4.1.3
ADDRESSING THIS VULNERABILITY FOR SUN3 AND SUN4 ARCHITECTURES.  SUN
HAS ALSO DEVELOPED A PATCH FOR SUNOS 5.X/SOLARIS 2.X SYSTEMS.   THIS
REVISED ADVISORY PROVIDES THE INFORMATION FOR OBTAINING THE PATCH FOR
SUNOS 5.X/SOLARIS 2.X SYSTEMS.  A WORKAROUND IS PROVIDED BELOW THAT
CAN BE USED ON ALL SYSTEMS, INCLUDING SOLARIS, UNTIL A PATCH IS
INSTALLED.  THE PATCH CAN BE OBTAINED FROM LOCAL SUN ANSWER CENTERS
WORLDWIDE AS WELL AS THROUGH ANONYMOUS FTP FROM THE FTP.UU.NET
(192.48.96.9) SYSTEM IN THE /SYSTEMS/SUN/SUN-DIST DIRECTORY.  IN
EUROPE, THIS PATCH IS AVAILABLE FROM MCSUN.EU.NET (192.16.202.1) IN
THE /SUN/FIXES DIRECTORY.
SYSTEM        PATCH ID     FILENAME           BSD           SOLARIS 
                                              CHECKSUM      CHECKSUM
------        --------     --------           ------------  -------
SUNOS         101080-01    101080-01.TAR.Z    45221    13   N/A
SOLARIS 2.0   101119-01    101119-01.TAR.Z    47944    27   61863  54
SOLARIS 2.1   101089-01    101089-01.TAR.Z    07227    27    4501  54
SOLARIS 2.2   101090-01    101090-01.TAR.Z    02491    27   44985  54

THE CHECKSUMS SHOWN ABOVE ARE FROM THE BSD-BASED CHECKSUM (ON
SOLARIS, /USR/UCB/SUM; ON 4.X, /BIN/SUM) AND FROM THE "NEW" SYSV
VERSION THAT SUN RELEASED ON SOLARIS (/USR/BIN/SUM).  NOTE THAT SUN
SOMETIMES UPDATES PATCH FILES.  IF YOU FIND THAT THE CHECKSUM IS
DIFFERENT PLEASE CONTACT SUN FOR VERIFICATION.
3.  PROBLEM DESCRIPTION: EXPRESERVE IS A UTILITY THAT PRESERVES THE
STATE OF A FILE BEING EDITED BY VI(1) OR EX(1) WHEN AN EDIT SESSION
TERMINATES ABNORMALLY OR WHEN THE SYSTEM CRASHES.  A VULNERABILITY
EXISTS THAT ALLOWS USERS TO OVERWRITE ANY FILE ON THE SYSTEM.  IT IS
POSSIBLE TO GAIN ROOT PRIVILEGES USING THIS VULNERABILITY.  SOLUTION:
OBTAIN AND INSTALL THE APPROPRIATE PATCH ACCORDING TO THE
INSTRUCTIONS INCLUDED WITH THE PATCH.
UNTIL YOU ARE ABLE TO INSTALL THE APPROPRIATE PATCH, ASSIST
RECOMMENDS THE FOLLOWING WORKAROUND BE USED ON ALL DOD SYSTEMS.  THIS
WORKAROUND WILL DISABLE EXPRESERVE FUNCTIONALITY.  THE RESULT OF THIS
WORKAROUND IS THAT IF VI(1) OR EX(1) IS RUNNING, AND THE SESSIONS ARE
INTERRUPTED, THE FILES BEING EDITED WILL NOT BE PRESERVED AND ALL
EDITS NOT EXPLICITLY SAVED BY THE USER WILL BE LOST.  USERS SHOULD BE
ENCOURAGED TO SAVE THEIR FILES OFTEN WHILE THE WORKAROUND IS IN
PLACE.  THE WORKAROUND CAN BE IMPLEMENTED AS FOLLOWS: AS ROOT, REMOVE
THE EXECUTE PERMISSIONS ON THE EXISTING /USR/LIB/EXPRESERVE PROGRAM:
# /BIN/CHMOD  A-X  /USR/LIB/EXPRESERVE 
4.  POINT OF CONTACT:  ASSIST POINT OF CONTACT FOR THIS MATTER IS
PETE HAMMES, COMM (703) 696-1924/5/6 OR DSN 226-1924/5/6.  ASSIST CAN
BE REACHED 24 HOURS PER DAY, COMMERCIAL PAGER (800) SKY-PAGE (800-
759-7243), PIN NUMBER 2133937.  WHEN CALLING THE PAGER SERVICE,
FOLLOW THE AUTOMATED VOICE INSTRUCTIONS AND ENTER THE CALL BACK
NUMBER AFTER THE PROMPT.  THE ASSIST DUTY OFFICER WILL CALL YOU BACK
WITHIN 30 MINUTES.  IF FASTER SERVICE IS REQUIRED, PREFIX YOUR
TELEPHONE NUMBER WITH "999", AND THE ASSIST DUTY OFFICER WILL CALL
BACK WITHIN 5 MINUTES.  ASSIST CAN ALSO BE REACHED VIA E-MAIL AT
"DOD-CERT(AT-SIGN)DDN-CONUS.DDN.MIL", BY DIALING INTO THE ASSIST
ELECTRONIC BULLETIN BOARD AT (703) 696-8726, DSN 226, AND LEAVING A
MESSAGE FOR THE SYSOP, OR BY LEAVING A VOICE MAIL MESSAGE FOR THE
ASSIST TEAM AT (703) 696-1904 (SELECT '9').
BT