=============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : CERT-NL (Don Stikvoort) Index : S-94-24 Distribution : World Page : 1 Classification: External Version: Final Subject : DEC ULTRIX and OSF/1 vulnerabilities Date : 23-Dec-94 =============================================================================== By courtesy of Digital Equipment Corporation and CERT/CC we received the following information about DEC ULTRIX and OSF/1 vulnerabilities. The information is dated 17-May-94 and has been issued by CERT-NL before in a compressed format as part of S-94-18 and S-94-18.APPENDIX of 15-Jul-94, the latest advisory on "Sendmail Vulnerabilities". So there's nothing NEW to be read here, but because Digital's fixes concerned MORE than only Sendmail the original Digital advisory is given here in full for those who did NOT heed S-94-18, e.g. because they don't use Sendmail! How to get other CERT-NL advisories and how to contact us, you will find at the very bottom of this document. =============================================================================== SOURCE: Digital Equipment Corporation - ( DSIN / DSNlink FLASH MAIL ) Software Security Response Team 17.MAY.94 PRODUCT: ULTRIX Versions 4.3, 4.3A, V4.4 DECnet-ULTRIX Version 4.2 DEC OSF/1 Versions 1.2, 1.3, 1.3A, 2.0 ADVISORY INFORMATION: SUBJECT: Security Enhanced Kit for DECNET-ULTRIX V4.2, ULTRIX V4.3 (VAX/RISC), ULTRIX V4.3A (RISC), ULTRIX V4.4 (VAX/RISC), ULTRIX Worksystem Software and DEC OSF/1 V1.2 - V2.0 IMPACT: Potential security vulnerabilities exist where, under certain circumstances user access or privilege may be expanded. SOLUTION: ULTRIX: Upgrade/Install ULTRIX to an minimum of V4.4 and install the Security Enhanced Kit DEC OSF/1: Upgrade/Install to a minimum of V1.2 and install the Security Enhanced Kit [Note: In the text below, Digital identifies OSF/1 V2.0 as the minimum. Digital has confirmed that 2.0 is correct. --CERT staff] _______________________________________________________________________________ These kits are available from Digital Equipment Corporation by contacting your normal Digital support channel or by request via DSNlink for electronic transfer. _______________________________________________________________________________ IMPACT: Digital has discovered the existence of potential security vulnerabilities in the ULTRIX V4.3, V4.3a, V4.4 and DEC OSF/1 V1.2, V1.3, V2.0 Operating Systems, and DECnet-ULTRIX V4.2. These potential vulnerabilities were discovered as a result of evaluating recent reports of potential security vulnerabilities which were distributed on the INTERNET and as a result of Digital's continued engineering efforts. The solutions to these vulnerabilities have been included in the next release of ULTRIX and DEC OSF/1. The kits have been created to correct potential security vulnerabilities which, under certain circumstances may expand user access or privilege. Digital Equipment Corporation strongly urges Customers to upgrade to a minimum of ULTRIX V4.4 and DEC OSF/1 V2.0 then apply the Security Enhanced Kit. - Please refer to the applicable Release Note information prior to upgrading your installation. _______________________________________________________________________________ KIT PART NUMBERS and DESCRIPTIONS CSC PATCH # CSCPAT_4060 V1.0 ULTRIX V4.3 thru V4.4 (Includes DECnet-ULTRIX V4.2) CSCPAT_4061 V1.0 DEC OSF/1 V1.2 thru V2.0 _______________________________________________________________ These kits will not install on versions previous to ULTRIX V4.3 or DEC OSF/1 V1.2. _______________________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________ The ULTRIX Security Enhanced kit replaces the following images: /usr/etc/comsat ULTRIX V4.3, V4.3a, V4.4 /usr/ucb/lpr " " /usr/bin/mail " " /usr/lib/sendmail " " /usr/etc/telnetd ULTRIX V4.3, V4.3a only ______________________________________ for DECnet-ULTRIX V4.2 installations: /usr/etc/dlogind /usr/etc/telnetd.gw *sendmail - is a previously distributed solution. _______________________________________________________________________________ The DEC OSF/1 Security Enhanced kit replaces the following images: /usr/sbin/comsat DEC OSF/1 V1.2, V1.3 V2.0 /usr/bin/binmail /usr/bin/lpr " " /usr/sbin/sendmail DEC OSF/1 V1.2, V1.3 only /usr/bin/rdist " " /usr/shlib/libsecurity.so DEC OSF/1 V2.0 only *sendmail - is a previously distributed solution. _______________________________________________________________________________ Digital urges you to periodically review your system management and security procedures. Digital will continue to review and enhance the security features of its products and work with customers to maintain and improve the security and integrity of their systems. _______________________________________________________________________________ NOTE: For non-contract/non-warranty customers contact your local Digital support channels for information regarding these kits. ______________________________________________________________________________ ============================================================================== CERT-NL is the Computer Emergency Response Team, located in The Netherlands. CERT-NL is a Full Member of the Forum of Incident Response and Security Teams (FIRST). The constituency of CERT-NL are the SURFnet connected institutions. Past CERT-NL Security Bulletins and other CERT-NL related material can be found on the anonymous FTP server of SURFnet bv: ftp://ftp.nic.surfnet.nl/surfnet/net-security/cert-nl/docs/bulletin This information is also available using email. Send an email saying "help" to "mailserv@nic.surfnet.nl". In case of computer or network security problems please contact CERT-NL or the CERT of your own constituency. Please be aware of the fact that we are one (when DST is in effect two) hour(s) ahead of Universal Time Coordinated (i.e. UTC+0100 (UTC+0200)). Email: cert-nl@surfnet.nl Phone: +31 30 310290 Fax: +31 30 340903 Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST members on request. ==============================================================================