From ciac@tholia.llnl.gov Fri May 22 16:42:59 1998 From: CIAC Mail User To: ciac-bulletin@tholia.llnl.gov Date: Thu, 21 May 1998 10:35:12 -0700 (PDT) Subject: CIAC Bulletin I-052: 3ComŽ CoreBuilder and SuperStack II LAN Vulnerabilities [ For Public Release ] -----BEGIN PGP SIGNED MESSAGE----- __________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN 3ComŽ CoreBuilder and SuperStack II LAN Vulnerabilities May 20, 1998 16:00 GMT Number I-052 ______________________________________________________________________________ PROBLEM: 3ComŽ CoreBuilder and SuperStack II LAN swithces may be vulnerable to security breaches caused by unauthorized access via special logins. DAMAGE: By exploiting this vulnerability, remote users may gain unauthorized access to switch configuration information. SOLUTION: Perform the recommended password changes detailed in this advisory. ______________________________________________________________________________ VULNERABILITY Exploit information involving this vulnerability has been made ASSESSMENT: publicly available. ______________________________________________________________________________ [Start 3ComŽ Advisory] 3ComŽ Security Advisory for CoreBuilder and SuperStack II Customers 3Com is issuing a security advisory affecting select CoreBuilder LAN switches and SuperStack II Switch products. This is in response to the widespread distribution of special logins intended for service and recovery procedures issued only by 3Com's Customer Service Organization under conditions of extreme emergency, such as in the event of a customer losing passwords. Due to this disclosure some 3Com switching products may be vulnerable to security breaches caused by unauthorized access via special logins. To address these issues, customers should immediately log in to their switches via the following usernames and passwords. They should then proceed to change the password via the appropriate Password parameter to prevent unauthorized access. CoreBuilder 6000/2500 - username: debug password: synnet CoreBuilder 7000 - username: tech password: tech SuperStack II Switch 2200 - username: debug password: synnet SuperStack II Switch 2700 - username: tech password: tech The CoreBuilder 3500, SuperStack II Switch 3900 and 9300 also have these mechanisms, but the special login password is changed to match the admin level password when the admin level password is changed. Customers should also immediately change the SNMP Community string from the default to a proprietary and confidential identifier known only to authorized network management staff. This is due to the fact that the admin password is available through a specific proprietary MIB variable when accessed through the read/write SNMP community string. This issue applies only to the CoreBuilder 2500/6000/3500 and SuperStack II Switch 2200/3900/9300. Fixed versions of software will be available from 3Com for all of these products by Wednesday 20th May 1998. General administration of these systems should still be performed through the normal documented usernames and passwords. Other facilities found under these special logins are for diagnostic purposes and should only be used under specific guidance from 3Com's Customer Service Organization. For more information 3Com has dedicated a hotline at 1-888-225-1733, or you can contact your local 3Com Customer Service location. [End 3ComŽ Advisory] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of 3ComŽ for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@llnl.gov For emergencies and off-hour assistance, DOE, DOE contractor sites, and the NIH may contact CIAC 24-hours a day. During off hours (5PM - 8AM PST), call the CIAC voice number 925-422-8193 and leave a message, or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC duty person, and the secondary PIN number, 8550074 is for the CIAC Project Leader. Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ (or http://ciac.llnl.gov -- they're the same machine) Anonymous FTP: ftp.ciac.org (or ciac.llnl.gov -- they're the same machine) Modem access: +1 (925) 423-4753 (28.8K baud) +1 (925) 423-3331 (28.8K baud) CIAC has several self-subscribing mailing lists for electronic publications: 1. CIAC-BULLETIN for Advisories, highest priority - time critical information and Bulletins, important computer security information; 2. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI) software updates, new features, distribution and availability; 3. SPI-NOTES, for discussion of problems and solutions regarding the use of SPI products. Our mailing lists are managed by a public domain software package called Majordomo, which ignores E-mail header subject lines. To subscribe (add yourself) to one of our mailing lists, send the following request as the E-mail message body, substituting ciac-bulletin, spi-announce OR spi-notes for list-name: E-mail to ciac-listproc@llnl.gov or majordomo@tholia.llnl.gov: subscribe list-name e.g., subscribe ciac-bulletin You will receive an acknowledgment email immediately with a confirmation that you will need to mail back to the addresses above, as per the instructions in the email. This is a partial protection to make sure you are really the one who asked to be signed up for the list in question. If you include the word 'help' in the body of an email to the above address, it will also send back an information file on how to subscribe/unsubscribe, get past issues of CIAC bulletins via email, etc. PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) I-042: SGI IRIX lp(1) Security Vulnerability I-043: SGI IRIX mailcap Vulnerability I-044: BIND Vulnerabilities I-045: SGI IRIX LicenseManager(1M) Vulnerabilities I-046: Open Group xterm and Xaw Library Vulnerabilities I-047: HP-UX OpenMail Vulnerability I-048: SunOS mountd Vulnerability I-049: SunOS ufsrestore Vulnerability I-050: Digital UNIX Softlinks - advfs Vulnerability I-051: FreeBSD T/TCP Vulnerability -----BEGIN PGP SIGNATURE----- Version: 4.0 Business Edition iQCVAwUBNWMR3LnzJzdsy3QZAQHdtwP+MplDtN/WbBSTiSknrL0yovTJ8iDJ7BWZ J7c6NZJw8ogWRLLBeMoJIGMCX4Xsx8QtKuk1zYZ9zaqAnjTcFtGp+GDvcjjg6gdL mDhWdcoidbIzQNjrrmRbZFlPkMABg8Pq/9HVHr9uAabaw/N7AObxCp+GdmSlrtWd hobL+oLJ+Q0= =hyOX -----END PGP SIGNATURE-----