=============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : CERT-NL (Don Stikvoort) Index : S-93-21 Distribution : World Page : 1 Classification: External Version: Final Subject : /usr/lib/sendmail , /bin/tar , Date : 22-Oct-93 /dev/audio vulnerabilities ============================================================================== CERT-NL received information about three SunOS and Solaris vulnerabilities: /usr/lib/sendmail, /bin/tar, and /dev/audio The first vulnerability is being actively exploited so take extra care! We advise you to take proper action, get patches and install them. In the below CERT/CC report all details are shown. We thank CERT/CC for providing this information. ============================================================================== ============================================================================== The CERT Coordination Center has learned of several vulnerabilities affecting Sun Microsystems, Inc. (Sun) operating systems. Three separate vulnerabilities are described in this advisory. The first and third vulnerabilities affect all versions of SunOS 4.1.x and all versions of Solaris 2.x. The second affects all systems running any version of Solaris 2.x (but does not affect SunOS 4.1.x systems). Patches can be obtained from local Sun Answer Centers worldwide as well as through anonymous FTP from : FOR SURFNET : info.nic.surfnet.nl in the /surfnet/net-security/cert-nl/patches/sun-fixes directory (FTP-archive also reachable through Gopher) Information concerning specific patches is outlined below. Please note that Sun sometimes updates patch files. If you find that the checksum is different, please contact Sun. ----------------------------------------------------------------------------- I. /usr/lib/sendmail Vulnerability This vulnerability affects all versions of SunOS 4.1.x including 4.1.1, 4.1.2, 4.1.3, 4.1.3c, and all versions of Solaris 2.x including Solaris 2.1 (SunOS 5.1) and Solaris 2.2 (SunOS 5.2). Sun is preparing a version of this patch for Solaris 2.3 but no patch ID is available at this time. ** This vulnerability is being actively exploited and we strongly recommend that sites take immediate and corrective action. ** A. Description A vulnerability exists in /usr/lib/sendmail such that remote users may gain access to affected systems. B. Impact Unauthorized access to affected systems may occur. C. Solution 1. Obtain and install the appropriate patch following the instructions included with the patch. System Patch ID Filename BSD Solaris Checksum Checksum ------ -------- --------------- --------- ----------- SunOS 4.1.x 100377-07 100377-07.tar.Z 36122 586 11735 1171 Solaris 2.1 100840-03 100840-03.tar.Z 01153 194 39753 388 Solaris 2.2 101077-03 101077-03.tar.Z 49343 177 63311 353 The checksums shown above are from the BSD-based checksum (on 4.1.x, /bin/sum; on Solaris, /usr/ucb/sum) and from the SVR4 version that Sun has released with Solaris (/usr/bin/sum). II. Solaris 2.x /bin/tar Vulnerability This vulnerability exists in all versions of Solaris 2.x including Solaris 2.1 and Solaris 2.2. Information about patches for current versions of Solaris is described below. Sun is preparing a patch for the upcoming Solaris 2.3 release. The patch ID will be 101327-01, and it will be available as soon as Solaris 2.3 is shipped. This vulnerability does not exist in SunOS 4.1.x systems. A. Description A security vulnerability exists in /bin/tar such that tarfiles created using this utility may incorporate portions of the /etc/passwd file. B. Impact Usernames and other information from /etc/passwd and /etc/group may be disclosed. However, since Solaris 2.x uses shadow passwords, encrypted passwords should not appear in /etc/passwd and therefore should not be disclosed by this vulnerability. C. Solution We recommend that all affected sites take the following steps to secure their systems. 1. Obtain and install the appropriate patch following the instructions included with the patch. System Patch ID Filename BSD Solaris Checksum Checksum ------ -------- --------------- --------- ----------- Solaris 2.1 100975-02 100975-02.tar.Z 37034 374 13460 747 Solaris 2.2 101301-01 101301-01.tar.Z 22089 390 4703 779 The checksums shown above are from the BSD-based checksum (on 4.1.x, /bin/sum; on Solaris, /usr/ucb/sum) and from the SVR4 version that Sun has released with Solaris 2.x (/usr/bin/sum). 2. If your site is not using shadow passwords, we recommend that all passwords be changed, especially those for sensitive accounts such as root. 3. Depending upon the sensitivity of the information contained in the /etc/passwd file, sites may wish to replace existing tar files where this is possible. Restoring an existing archive file, and then producing a new tarfile with the patched tar, will result in a clean archive file. III. /dev/audio Vulnerability This vulnerability affects all Sun systems with microphones. This includes all versions of SunOS 4.1.x including 4.1.1, 4.1.2, 4.1.3, 4.1.3c, and all versions of Solaris 2.x including Solaris 2.1 (SunOS 5.1) and Solaris 2.2 (SunOS 5.2). Sun is addressing this problem in Solaris 2.3. A. Description /dev/audio is set to a default mode of 666. There is also no indication to the user of the system that the microphone is on. B. Impact Any user with access to the system can eavesdrop on conversations held in the vicinity of the microphone. C. Solution To prevent unauthorized listening with the microphone, the permissions of the audio data device (/dev/audio) should allow only the user logged in on the console of the machine to read /dev/audio. To prevent unauthorized changes in playback and record settings, the permissions on /dev/audioctl should be similarly changed. *** Any site seriously concerned about the security risks associated with the microphone should either switch off the microphone, or unplug the microphone to prevent unauthorized listening. *** 1. Restricting access on 4.x systems Use fbtab(5) to restrict the access to these devices. See the man page for more information about this procedure. 2. Restricting access on Solaris 2.x systems To restrict access to these devices to a specific users, the permissions on the device files must be manually changed. As root: # chmod 600 /dev/audio # chown . /dev/audio # chmod 600 /dev/audioctl # chown . /dev/audio --------------------------------------------------------------------------- The CERT Coordination Center wishes to thank Paul De Bra, Department of Computing Science, Eindhoven University of Technology; David Slade of Bellcore; and Mabry Tyson of SRI for reporting these vulnerabilities, and Sun Microsystems, Inc. for their response to these problems. --------------------------------------------------------------------------- ============================================================================== ============================================================================== CERT-NL is the Computer Emergency Response Team, located in The Netherlands. CERT-NL is a Full Member of the Forum of Incident Response and Security Teams (FIRST). The constituency of CERT-NL are the SURFnet connected institutions. Past CERT-NL Security Bulletins and other CERT-NL related material can be found on the anonymous FTP server of SURFnet bv: "ftp.nic.surfnet.nl" [192.87.46.3], in the directory "surfnet/net-security/cert-nl/docs/bulletin". This information is also available using email. Send an email saying "help" to "mailserv@nic.surfnet.nl". In case of computer or network security problems please contact CERT-NL or the CERT of your own constituency. Please be aware of the fact that we are one (when DST is in effect two) hour(s) ahead of Universal Time Coordinated (i.e. UTC+0100 (UTC+0200)). Email: cert-nl@surfnet.nl Phone: +31 30 310290 Fax: +31 30 340903 Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands A 7*24h phonenumber is available to SURFnet SSC's and FIRST members on request =============================================================================