Conference turris::digital_unix

8830.0. "CERT(sm) Advisory CA-97.06" by BACHUS::ROETS (Chris Roets) Fri Feb 14 1997 02:51

    Hello Guys,
    
    Does anybody known where I can find the CERT(sm) Advisory CA-97.06
    for Digital Unix and Ultrix ?
    
    below is the complete advisary
    **********************************************************
    
    -----BEGIN PGP SIGNED MESSAGE-----
    
    =============================================================================
    CERT(sm) Advisory CA-97.06
    Original issue date: February 6, 1997
    Last revised: February 11, 1997
                  Appendix A - added entries for Cygnus Solutions, NetBSD,
    and Sun
    
    Topic: Vulnerability in rlogin/term
    -
    -----------------------------------------------------------------------------
    
    The CERT Coordination Center has received reports of a vulnerability in
    many
    implementations of the rlogin program, including eklogin and klogin. By
    exploiting this vulnerability, users with access to an account on the
    system
    can cause a buffer overflow and execute arbitrary programs as root.
    
    The CERT/CC staff recommends installing a vendor patch for this problem
    (Sec. III.A). Until you can do so, we urge you to turn off rlogin or
    replace
    it with a wrapper (see Sec. III.B.2).
    
    We will update this advisory as we receive additional information.
    Please check advisory files regularly for updates that relate to your
    site.
    
    -
    -----------------------------------------------------------------------------
    
    I.   Description
    
         The rlogin program provided by many UNIX systems, as well as some
    non-UNIX
         systems, is described in RFC 1282. Here is an excerpt from that
    RFC that
         describes its elemental functionality:
    
            "The rlogin facility provides a remote-echoed, locally flow-
             controlled virtual terminal with proper flushing of output.
             It is widely used between Unix hosts because it provides
             transport of more of the Unix terminal environment semantics
             than does the Telnet protocol, and because on many Unix hosts
             it can be configured not to require user entry of passwords
             when connections originate from trusted hosts."
    
         The key point from this description is that the rlogin program
    passes
         the terminal type description from the local host to the remote
    host.
         This functionality allows terminal-aware programs such as
    full-screen
         text editors to operate properly across a computer-to-computer
         connection created with rlogin.
    
         To do this, the rlogin program uses the current terminal
    definition as
         identified by the TERM environment variable. The protocol
    described in
         RFC 1282 explains how this terminal information is transferred
    from the
         local machine where the rlogin client program is running to the
    remote
         machine where service is sought.
    
         Unfortunately, many implementations of the rlogin program contain
    a
         defect whereby the value of the TERM environment variable is
    copied to
         an internal buffer without due care. The buffer holding the copied
    value
         of TERM can be overflowed. In some implementations, the buffer is
    a local
         variable, meaning that the subroutine call stack can be
    overwritten and
         arbitrary code executed. The executed code is under the control of
    the
         user running the rlogin program.
    
         In addition, the rlogin program is set-user-id root. rlogin
    requires
         these increased privileges so it can allocate a port in the
    required
         range, as described in the in.rlogind (or rlogind) manual page:
    
             "The server checks the client's source port. If the port is
    not
              in the range 0-1023, the server aborts the connection."
    
         In summary, rlogin is a set-user-id root program that in many
         implementations contains a programming defect whereby an internal
    buffer
         can be overflowed and arbitrary code can be executed as root.
    
    II.  Impact
    
         Users can become root if they have access to an account on the
    system.
    
    III. Solution
    
         Install a patch from your vendor if one is available (Section A).
         Until you can take one of those actions, we recommend applying the
         workaround described in Section B.
    
         A.  Obtain and install a patch for this problem.
    
             Below is a list of vendors who have provided information about
             rlogin. Details are in Appendix A of this advisory; we will
    update
             the appendix as we receive more information. If your vendor's
    name is
             not on this list, the CERT/CC did not hear from that vendor.
    Please
             contact your vendor directly.
    
                  Berkeley Software Design, Inc. (BSDI)
                  Cray Research - A Silicon Graphics Company
                  Cygnus Solutions (formerly Cygnus Support)
                  Digital Equipment Corporation
                  FreeBSD, Inc.
                  Hewlett-Packard Corporation
                  IBM Corporation
                  Linux Systems
                  NEC Corporation
                  NetBSD
                  NeXT Software, Inc.
                  The Open Group
                  The Santa Cruz Operation (SCO)
                  Sun Microsystems, Inc.
    
         B.  Until you are able to install the appropriate patch, we
    recommend
             one of the following workarounds:
    
             1. Turn off rlogin.
                If your user community does not use rlogin, turn it off.
                As root, do the following:
    
                    % chmod 0 /usr/bin/rlogin
    
                You may find the rlogin program in some other directory on
                your system. Example directories are: /bin, /usr/bin,
    /usr/ucb.
    
                Note: On some systems, rlogin is provided in different
    forms
                that do additional work. Examples are eklogin (kerberos
                authentication plus encryption of the data stream) and
    klogin
                (kerberos authentication only). These, too, need to be
    turned
                off.
    
             2. Replace the rlogin program with a wrapper.
                We have written a prototype wrapper that is available at
    
              URL
    ftp://info.cert.org/pub/tools/rlogin_wrapper/rlogin_wrapper.c
    
                The PGP signature for this file is available at
    
              URL
    ftp://info.cert.org/pub/tools/rlogin_wrapper/rlogin_wrapper.c.asc
    
                To verify that this file is correct, fetch both the
                rlogin_wrapper.c and rlogin_wrapper.c.asc files and check
    the
                signature with pgp as in
    
                   % pgp rlogin_wrapper.c.asc rlogin_wrapper.c
    
                Notes:
                   * You may have to change this program to get it to
    compile and
                      work correctly on your system.
    
                   * If you have different forms of rlogin, as noted in the
                      previous section, then you will need to replace those
    forms
                      with the wrapper as well.
    
    ...........................................................................
    
    Appendix A - Vendor Information
    
    Below is a list of the vendors who have provided information for this
    advisory. We will update this appendix as we receive additional
    information.
    If you do not see your vendor's name, the CERT/CC did not hear from
    that
    vendor. Please contact the vendor directly.
    
    
    Berkeley Software Design, Inc. (BSDI)
    ====================================
            Unpatched BSD/OS 2.1 systems are vulnerable to this problem.  A
    patch
            was issued that resolved this problem in August 1996.  The
    patch is
            available from the <[email protected]> mail server or via
    anonymous ftp
            at:
    
                 ftp://ftp.bsdi.com/bsdi/patches/patches-2.1/U210-021
    
    
    Cray Research - A Silicon Graphics Company
    ==========================================
            This problem has been corrected in all currently supported
    versions
            of Unicos.
    
    
    Cygnus Solutions (formerly Cygnus Support)
    ==========================================
           CNS (our product based on Kerberos V4) all releases are not
           vulnerable.
    
           KerbNet Security System (our product based on Kerberos V5) all
           releases are not vulnerable.
    
      Since our version of rlogin is not installed set-user-id root, it is
      not vulnerable.  To secure a machine which is running our rlogin, all
      that is necessary is to secure the vendor rlogin.
    
    
    Digital Equipment Corporation
    =============================
            At the time of writing this document, patches(binary kits) are
            available from your normal Digital Support Channel.
    
            rlogin patches are available for:
                DIGITAL UNIX V3.2c, V3.2de1/de2, V3.2g, V3.2g, V4.0, V4.0a,
    V4.0b.
                DIGITAL ULTRIX V4.4 VAX & MIPS, V4.5 VAX and MIPS
    
                                    DIGITAL EQUIPMENT CORPORATION
                                    -----------------------------
    
    FreeBSD, Inc.
    =============
            This vulnerability is present in FreeBSD 2.1.5 and previous
            versions.  It was fixed in all FreeBSD source and
            binary distributions dated after 1996/07/25.
    
            The following source code patch may be applied to FreeBSD
            2.1.5 based distributions, and should work in previous
            distributions.  Users unable to apply this patch and
            recompile the rlogin binary are encouraged to use the
            wrapper provided by CERT.
    
    
    Index: rlogin.c
    ===================================================================
    RCS file: /home/ncvs/src/usr.bin/rlogin/rlogin.c,v
    retrieving revision 1.5.4.1
    retrieving revision 1.5.4.2
    diff -c -r1.5.4.1 -r1.5.4.2
    *** rlogin.c	1996/06/23 13:08:27	1.5.4.1
    - --- rlogin.c	1996/07/25 18:29:35	1.5.4.2
    ***************
    *** 102,107 ****
    - --- 102,108 ----
      char *speeds[] = {
      	"0", "50", "75", "110", "134", "150", "200", "300", "600", "1200",
      	"1800", "2400", "4800", "9600", "19200", "38400", "57600", "115200"
    + #define	MAX_SPEED_LENGTH	(sizeof("115200") - 1)
      };
    
      #ifdef OLDSUN
    ***************
    *** 259,265 ****
      		exit(1);
      	}
    
    ! 	(void)strcpy(term, (p = getenv("TERM")) ? p : "network");
      	if (ioctl(0, TIOCGETP, &ttyb) == 0) {
      		(void)strcat(term, "/");
      		(void)strcat(term, speeds[(int)ttyb.sg_ospeed]);
    - --- 260,270 ----
      		exit(1);
      	}
    
    ! #define	MAX_TERM_LENGTH	(sizeof(term) - 1 - MAX_SPEED_LENGTH - 1)
    !
    ! 	(void)strncpy(term, (p = getenv("TERM")) ? p : "network",
    ! 		      MAX_TERM_LENGTH);
    ! 	term[MAX_TERM_LENGTH] = '\0';
      	if (ioctl(0, TIOCGETP, &ttyb) == 0) {
      		(void)strcat(term, "/");
      		(void)strcat(term, speeds[(int)ttyb.sg_ospeed]);
    
    
    Hewlett-Packard Corporation
    ===========================
            This rlogin problem is fixed:
    
            PHNE_8807 10.20        s700/800
            PHNE_8806 10.10, 10.0X s700/800
            PHNE_8805 9.X          s700/800
    
            See Hewlett-Packard Security Bulletin HPSBUX9702-052, dated
            February 5, 1997.
    
    
    IBM Corporation
    ===============
      See the appropriate release below to determine your action.
    
    
      AIX 3.2
      -------
        Apply the following fix to your system:
    
           APAR - IX57724 (PTF - U442613)
    
        To determine if you have this PTF on your system, run the following
        command:
    
           lslpp -lB U442613
    
    
      AIX 4.1
      -------
        Apply the following fix to your system:
    
            APAR - IX57972
    
        To determine if you have this APAR on your system, run the
    following
        command:
    
           instfix -ik IX57972
    
        Or run the following command:
    
           lslpp -h bos.net.tcp.client
    
        Your version of bos.net.tcp.client should be 4.1.4.13 or later.
    
    
      AIX 4.2
      -------
        No APAR required.  Fix already contained in the release.
    
    
      To Order
      --------
        APARs may be ordered using Electronic Fix Distribution (via
    FixDist)
        or from the IBM Support Center.  For more information on FixDist,
        reference URL:
    
           http://service.software.ibm.com/aixsupport/
    
        or send e-mail to [email protected] with a subject of
    "FixDist".
    
    
      IBM and AIX are registered trademarks of International Business
    Machines
      Corporation.
    
    
    Linux Systems
    =============
            Only very out of date Linux systems are vulnerable.
    
            Linux Netkit 0.08 has rlogin fixed. All Linux systems using
    older
            NetKits should upgrade to NetKit 0.09. Some vendors have
    shipped
            patched Netkit-0.08 releases. Check with your vendor for
            confirmation.
    
            NetKit 0.09 is available from:
    
           
    ftp://ftp.uk.linux.org/pub/linux/Networking/base/NetKit-0.09.tar.gz
    
    
    NEC Corporation
    ===============
            UX/4800             Not vulnerable for all versions.
            EWS-UX/V(Rel4.2MP)  Not vulnerable for all versions.
            EWS-UX/V(Rel4.2)    Not vulnerable for all versions.
            UP-UX/V(Rel4.2MP)   Not vulnerable for all versions.
    
    
    NetBSD
    ======
       This was fixed in NetBSD some time ago, and is part of the 1.2
    release.
    
       NetBSD 1.1 and prior are vulnerable to this, and the best solution
    is to
       upgrade, or at least obtain new src/usr.bin/rlogin source and
    recompile.
    
    
    NeXT Software, Inc.
    ===================
       This problem is fixed in OpenStep/Mach release 4.1 and later.
    
    
    The Open Group
    ==============
        This problem was fixed in OSF's OSF/1 R1.3.3 maintenance release.
    
    
    The Santa Cruz Operation (SCO)
    ==============================
         SCO is investigating this problem and should a patch be necessary,
    SCO
         will provide updated information for this advisory. Patches for
    SCO
         products are listed at ftp://ftp.sco.COM/SLS/README.
    
    Sun Microsystems, Inc.
    ======================
         No SunOS systems are vulnerable to this attack.
    
    -
    -----------------------------------------------------------------------------
    The CERT Coordination Center staff thanks AUSCERT and DFN-CERT for
    their
    contributions to the development of this advisory.
    -
    -----------------------------------------------------------------------------
    
    If you believe that your system has been compromised, contact the CERT
    Coordination Center or your representative in the Forum of Incident
    Response
    and Security Teams (see ftp://info.cert.org/pub/FIRST/first-contacts).
    
    
    CERT/CC Contact Information
    - ----------------------------
    Email    [email protected]
    
    Phone    +1 412-268-7090 (24-hour hotline)
                    CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) /
    EDT(GMT-4)
                    and are on call for emergencies during other hours.
    
    Fax      +1 412-268-6989
    
    Postal address
             CERT Coordination Center
             Software Engineering Institute
             Carnegie Mellon University
             Pittsburgh PA 15213-3890
             USA
    
    Using encryption
       We strongly urge you to encrypt sensitive information sent by email.
    We can
       support a shared DES key or PGP. Contact the CERT/CC for more
    information.
       Location of CERT PGP key
             ftp://info.cert.org/pub/CERT_PGP.key
    
    Getting security information
       CERT publications and other security information are available from
            http://www.cert.org/
            ftp://info.cert.org/pub/
    
       CERT advisories and bulletins are also posted on the USENET
    newsgroup
            comp.security.announce
    
       To be added to our mailing list for advisories and bulletins, send
    your
       email address to
            [email protected]
       In the subject line, type
            SUBSCRIBE  your-email-address
    
    -
    ---------------------------------------------------------------------------
    Copyright 1997 Carnegie Mellon University
    This material may be reproduced and distributed without permission
    provided
    it is used for non-commercial purposes and the copyright statement is
    included.
    
    CERT is a service mark of Carnegie Mellon University.
    -
    ---------------------------------------------------------------------------
    
    This file: ftp://info.cert.org/pub/cert_advisories/CA-97.06.rlogin-term
               http://www.cert.org
                   click on "CERT Advisories"
    
    
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Revision history
    
    Feb. 11, 1997  Appendix A - added entries for Cygnus Solutions, NetBSD,
    and
                    Sun Microsystems
    
    -----BEGIN PGP SIGNATURE-----
    Version: 2.6.2
    
    iQCVAwUBMwC9BHVP+x0t4w7BAQExzQP/exu/u5kkL3SKnsLy3YHm9sYvLXlbZJtQ
    ZqEmK4YUjGbsgXkSW2QAnxaZvYAXSJIzapMnnBKI0V18/zu5xGDiJdF18+HfPPc+
    xip4cRaSwyutsobpHgp2twGH5rRmmnEzKrpx+I8JOmybjyMfbSEJyq0xHWxQxWM3
    bQu1ePswKrs=
    =HSix
    -----END PGP SIGNATURE-----
    
    

http://www.cert.org/

Hi,

Thanks for your URL but I cannot find Digital Unix/Ultrix patches ...

Have you another ideas where I can get these patches ... ???

Kindly regards,

+---++---++---++---++---++---++---+ TM  Digital Equipment Belgium
|   ||   ||   ||   ||   ||   ||   |   Multivendor Customer Services
| d || i || g || i || t || a || l |         Thierry FAIDHERBE 
|   ||   ||   ||   ||   ||   ||   |      DIGITAL Unix Support Team
+---++---++---++---++---++---++---+  Email [email protected] 
            Phone : +32 2 729 77 44  Fax : +32 2 729 77 65
           With DIGITAL Unix, ... You get what you pay for ...
[Posted by WWW Notes gateway]

Hi
  There are some here
ftp://atlanta.service.digital.com/pub/mandatory_upgrades/AXP/OSF1/
or
ftp://service.digital.com.au/pub/csc_patches/rlogin

Adrian
[Posted by WWW Notes gateway]

    see note 8774.* and 8745.* 
    
    rich
    

Hi,

Thatks you for these url's ... !!!

Have a nice day,

Thierry

[Posted by WWW Notes gateway]

Hi,

Thanks you for these url's ... !!!

Have a nice day,

Thierry

[Posted by WWW Notes gateway]