Internet Info 1994 March

home *** CD-ROM | disk | FTP | other *** search

/ Internet Info 1994 March / Internet Info CD-ROM (Walnut Creek) (March 1994).iso / inet / scc / ddn-security-9224 < prev next >

Wrap

Text File | 1992-10-05 | 18.4 KB | 476 lines

************************************************************************** Security Bulletin 9224 DISA Defense Communications System October 6, 1992 Published by: DDN Security Coordination Center (SCC@NIC.DDN.MIL) 1-(800) 365-3642 DEFENSE DATA NETWORK SECURITY BULLETIN The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security Coordination Center) under DISA contract as a means of communicating information on network and host security exposures, fixes, and concerns to security and management personnel at DDN facilities. Back issues may be obtained via FTP (or Kermit) from NIC.DDN.MIL [192.112.36.5] using login="anonymous" and password="guest". The bulletin pathname is scc/ddn-security-yynn (where "yy" is the year the bulletin is issued and "nn" is a bulletin number, e.g., scc/ddn-security-9224). ************************************************************************** + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + ! ! ! The following important advisory was issued by the Computer ! ! Emergency Response Team (CERT) and is being relayed unedited ! ! via the Defense Information Systems Agency's Security ! ! Coordination Center distribution system as a means of ! ! providing DDN subscribers with useful security information. ! ! ! + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + ========================================================================== CA-92:17 CERT Advisory October 5, 1992 Hewlett-Packard NIS ypbind Vulnerability -------------------------------------------------------------------------- The CERT Coordination Center has received information concerning a vulnerability in the NIS ypbind module for the Hewlett-Packard (HP) HP/UX Operating System for series 300, 700, and 800 computers. HP is aware of the problem and has produced patches for HP/UX 8.xx versions. This problem is fixed in HP/UX 9.0. Architecture Patch ID Filename Checksum Series 300 PHNE_1359 /hp-ux_patches/s300_400/8.X/PHNE_1359 39206 214 Series 700 PHNE_1360 /hp-ux_patches/s700/8.X/PHNE_1360 37915 299 Series 800 PHNE_1361 /hp-ux_patches/s800/8.X/PHNE_1361 44288 299 The checksums listed above are for the patch archive files from HP. Once unpacked, each shell archive contains additional checksum information in the file "patchfilename.text". This checksum is applicable to the binary patch file "patchfilename.updt". These patches may be obtained from HP via ftp (this is NOT anonymous ftp) or the HP SupportLine. To obtain HP security patches, you must first register with the HP SupportLine. The registration instructions provided below will not be included in future advisories. If you have any questions about obtaining or installing the patches, contact the USA HP SupportLine at 415-691-3888 or your local HP SupportLine number. Please note that the telephone numbers in this advisory are for the USA and Canada. -------------------------------------------------------------------------- I. Description A vulnerability in HP NIS allows remote NIS servers unauthorized access to local NIS hosts. An HP NIS client will accept ypset requests from hosts outside its NIS domain. II. Impact Root on a remote host running any vendor's implementation of NIS can gain root access on any local host running HP's NIS ypbind. III. Solution All HP NIS clients and servers running ypbind should obtain and install the patch, as detailed below. The sections below include 1) instructions for registering with the HP SupportLine and obtaining the HP security patches, and 2) instructions for installing the patch provided by HP. The instructions for installing the patch are also provided in the PHNE_xxxx.text file (this file is created after the patch has been unpacked). ========================================================================= Beginning of Text provided by Hewlett-Packard ========================================================================= HP SupportLine Registration Instructions HP SupportLine phone number: 415-691-3888. Customers in three categories are eligible to obtain the security patches: 1) HP SupportLine customers who have a software support contract or have recently purchased an HP 9000 and who access the SupportLine via a terminal or modem. 2) HP SupportLine customers who have access via Internet. 3) Customers not currently accessing the HP SupportLine. For category 1: --------------- Step 1: Dial 415-691-3680. Step 2: When your communications program indicates that you are connected, press "return". The system prompt, ":" or "login:", should appear. Step 3: If your system prompt is ":", log on to the HP SupportLine account by typing "HELLO USER.HPSL", followed by "return". If your system prompt is "login:", log on by typing "login: hpsl", followed by "return". Step 4: When prompted, type your system handle and password; follow each with "return". Your system handle and password are provided in the cover letter you received with your "Getting Started Kit." Step 5: Press "return" until the HP SupportLine Top Menu screen is displayed. If your terminal does not support block mode, enable HPSL's line editor by typing "SET EDITOR LINE" at the command prompt and entering "return". For category 2: --------------- Step 1: HP 9000, HP Apollo, and HP 64000 system users who have been authorized by the National Science Foundation (NSF) to use Internet may access HP SupportLine over the Internet. Connect to HP SupportLine using the address provided in your "Getting Started Kit." U.S. login examples are telnet 192.6.148.19 or telnet support.mayfield.hp.com Step 2: Once you access HP SupportLine, type "hpsl" at the "login:" prompt. Step 3: When prompted, enter your system handle and password; follow each with "return". Your system handle and password are provided in the cover letter you received with your "Getting Started Kit." Step 4: Press "return" until the HP SupportLine Top Menu is displayed. Step 5: At the Top Menu, choose "3 Patch support information" by typing "3" at the "Select an item or enter a command (? for help) :" prompt. This will put you in the Patch Support Information Menu. Step 6: At the Patch Support Information Menu, choose "3 Retrieve patch file transfer login" to get your patch file transfer login by typing "3" at the "Select an item or enter a command (? for help) :" prompt. This will put you at a screen that allows you to choose the method for patch file transfers. The choices are ftp, kermit, and uucp. To choose ftp, type "1" at the "Enter selection :" prompt. The next screen will display your patch file transfer method and your patch file transfer login. You will use the *SAME* patch file login when you ftp patch file(s). Step 7: When you exit the HP SupportLine, by typing "E" at the "Select an item or enter a command (? for help) :" prompt, the connection is closed. Step 8: FTP to 192.6.148.19 or support.mayfield.hp.com Step 9: At the "Name (support.mayfield.hp.com:username):" prompt, type your patch file transfer login. Step 10: At the "Password:" prompt, type the password assigned to you by Hewlett-Packard when you registered. Step 11: At the "ftp>" prompt, set the transfer mode to binary by typing "bin". You should get a message "Type set to I". Step 12: At the "ftp>" prompt, cd to "hp-ux_patches". Then cd to the directory named for your type of architecture (s300_400, s700, or s800). Then cd to "8.X". Step 13: At the "ftp>" prompt, type "get PHNE_xxxx" (where xxxx is 1359, 1360, or 1361 - depending on the architecture of your host(s)). For category 3: --------------- Step 1: Dial 415-691-3680. Step 2: Type "hpslreg" at the "login:" prompt to begin the registration process. Step 3: Follow the instructional prompts. Step 4: Once you have received your HP SupportLine system handle and password, follow the directions in category 1) or 2), depending on your preferred access method. ======================================================================== Patch Installation Instructions Item Subject: PHNE_1359.text Patch Name: PHNE_1359 Patch Description: ypbind that accepts ypset only from local host This patch provides a special version of ypbind that accepts ypset requests only from the local host. This prevents a superuser on a remote system from issuing a ypset -h command to the local system to create a rogue ypserver. Path Name: /hp-ux_patches/s300_400/8.X/PHNE_1359 Effective Date: 920810 Patch Files: ypbind SR#: 1650-172619 "what" string/timestamp: ypbind ypbind: $Revision: 1.43.108.1.1.1 $ $Date: 91/12/12 18:10:30 $ "sum" output: 46857 200 ypbind Dependencies: None. Supersedes: None. Patch Package Size: 134 Kbytes Installation Instructions: Before installing this patch, please review all instructions and the Hewlett-Packard SupportLine User Guide or your Hewlett-Packard support terms and conditions for precautions, scope of license, restrictions, and limitation of liability and warranties, Note: Please back up your system before you patch. ------------------------------------------------------------------------ After getting the patch onto your machine, unshar the patch (sh PHNE_1359). To install this patch, do the following: 1) Run the update program. (Note: you must be logged in as root to update a system.) 2) Once in the update "Main Menu", move the highlighted line to "Change Source or Destination ->" and press "Return" or "Select Item". 3) Make sure the highlighted item in the "Change Source or Destination" window is "From Tape Device to Local System ...", then press "Return" or "Select Item". 4) You should now be in the "From Tape Device to Local System" window. Change the "Source: /dev/rmt/0m" to "Source: /tmp/PHNE_1359.updt" (this assumes that you are in the /tmp directory where PHNE_1359.updt has been placed). Note: You must enter the complete path name. 5) Press "Done". 6) From here on, follow the standard directions for update. The customized script that update runs will move the original software to /system/PHNE_1359/orig. In order to recover from any potential problems, HP recommends keeping the software there. HP also recommendeds that you move the PHNE_1359.text file to /system/PHNE_1359 and retain it for future reference. If you wish to put this patch on a magnetic tape and update from the tape drive, dd a copy of the patch to the tape drive. As an example, the following will create a copy of the patch that update can read: dd if=PHNE_1359.updt of=/dev/rmt/0m bs=2048 ....................................................................... Item Subject: PHNE_1360.text Patch Name: PHNE_1360 Patch Description: ypbind that accepts ypset only from local host This patch provides a special version of ypbind that accepts ypset requests only from the local host. This prevents a superuser on a remote system from issuing a ypset -h command to the local system to create a rogue ypserver. Path Name: /hp-ux_patches/s700/8.X/PHNE_1360 Effective Date: 920810 Patch Files: ypbind SR#: 1650-172619 "what" string/timestamp: ypbind ypbind: $Revision: 1.43.108.1.1.1 $ $Date: 91/12/12 18:10:30 $ "sum" output: 48068 256 ypbind Dependencies: None. Supersedes: None. Patch Package Size: 164 Kbytes Installation Instructions: Before installing this patch, please review all instructions and the Hewlett-Packard SupportLine User Guide or your Hewlett-Packard support terms and conditions for precautions, scope of license, restrictions, and limitation of liability and warranties. Note: Please back up your system before you patch. --------------------------------------------------------------------------- After getting the patch onto your machine, unshar the patch (sh PHNE_1360). To install this patch do the following: 1) Run the update program. (Note: you must be logged in as root to update a system.) 2) Once in the update "Main Menu", move the highlighted line to "Change Source or Destination ->" and press "Return" or "Select Item". 3) Make sure the highlighted item in the "Change Source or Destination" window is "From Tape Device to Local System ...", then press "Return" or "Select Item". 4) You should now be in the "From Tape Device to Local System" window. Change the "Source: /dev/rmt/0m" to "Source: /tmp/PHNE_1360.updt" (this assumes that you are in the /tmp directory where PHNE_1360.updt has been placed). Note: You must enter the complete path name. 5) Press "Done". 6) From here on, follow the standard directions for update. The customized script that update runs will move the original software to /system/PHNE_1360/orig. In order to recover from any potential problems, HP recommends keeping the software there. HP also recommendeds that you move the PHNE_1360.text file to /system/PHNE_1360 and retain it for future reference. If you wish to put this patch on a magnetic tape and update from the tape drive, dd a copy of the patch to the tape drive. As an example, the following will create a copy of the patch that update can read: dd if=PHNE_1360.updt of=/dev/rmt/0m bs=2048 ....................................................................... Item Subject: PHNE_1361.text Patch Name: PHNE_1361 Patch Description: ypbind that accepts ypset only from local host This patch provides a special version of ypbind that accepts ypset requests only from the local host. This prevents a superuser on a remote system from issuing a ypset -h command to the local system to create a rogue ypserver. Path Name: /hp-ux_patches/s800/8.X/PHNE_1361 Effective Date: 920810 Patch Files: ypbind SR#: 1650-172619 "what" string/timestamp: ypbind ypbind: $Revision: 1.43.108.1.1.1 $ $Date: 91/12/12 18:10:30 $ "sum" output: 48068 256 ypbind Dependencies: None. Supersedes: None. Patch Package Size: 164 Kbytes Installation Instructions: Before installing this patch, please review all instructions and the Hewlett-Packard SupportLine User Guide or your Hewlett-Packard support terms and conditions for precautions, scope of license, restrictions, and limitation of liability and warranties. Note: Please back up your system before you patch. --------------------------------------------------------------------------- After getting the patch onto your machine, unshar the patch (sh PHNE_1361). To install this patch do the following: 1) Run the update program. (Note: you must be logged in as root to update a system.) 2) Once in the update "Main Menu", move the highlighted line to "Change Source or Destination ->" and press "Return" or "Select Item". 3) Make sure the highlighted item in the "Change Source or Destination" window is "From Tape Device to Local System ...", then press "Return" or "Select Item". 4) You should now be in the "From Tape Device to Local System" window. Change the "Source: /dev/rmt/0m" to "Source: /tmp/PHNE_1361.updt" (this assumes that you are in the /tmp directory where PHNE_1361.updt has been placed). Note: You must enter the complete path name. 5) Press "Done". 6) From here on, follow the standard directions for update. The customized script that update runs will move the original software to /system/PHNE_1361/orig. In order to recover from any potential problems, HP recommends keeping this software there. HP also recommendeds that you move the PHNE_1361.text file to /system/PHNE_1361 and retain it for future reference. If you wish to put this patch on a magnetic tape and update from the tape drive, dd a copy of the patch to the tape drive. As an example the following will create a copy of the patch that update can read: dd if=PHNE_1361.updt of=/dev/rmt/0m bs=2048 ============================================================================ End of Text provided by Hewlett-Packard ============================================================================ ----------------------------------------------------------------------------- The CERT Coordination Center wishes to thank Brian Kelley of Ford Motor Company for bringing this vulnerability to our attention. We would also like to thank Hewlett-Packard for their response to this problem. ----------------------------------------------------------------------------- If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in FIRST (Forum of Incident Response and Security Teams). Internet E-mail: cert@cert.org Telephone: 412-268-7090 (24-hour hotline) CERT personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4), on call for emergencies during other hours. CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 Past advisories, information about FIRST representatives, and other information related to computer security are available for anonymous ftp from cert.org (192.88.209.5). **************************************************************************** * * * The point of contact for MILNET security-related incidents is the * * Security Coordination Center (SCC). * * * * E-mail address: SCC@NIC.DDN.MIL * * * * Telephone: 1-(800)-365-3642 * * * * NIC Help Desk personnel are available from 7:00 a.m.-7:00 p.m. EST, * * Monday through Friday except on federal holidays. * * * ****************************************************************************