CERT Advisory VB-94:02.dec

Wed Dec 14 21:30:40 UTC 1994

CERT Vendor-Initiated Bulletin VB-94:02
December 14, 1994

Topic:  Security Advisory #0505 ULTRIX and DEC OSF/1
Source: Digital Equipment Corporation, Software Security Response Team
Related CERT documents: CERT Advisory CA-94:12 "Sendmail Vulnerabilities"

To aid in the wide distribution of essential security information, the CERT
Coordination Center is forwarding the following information from Digital
Equipment Corp.  Digital urges you to act on this information as soon as
possible. Digital contact information is included in the forwarded text
below; please contact them if you have any questions or need further
information.

===========================FORWARDED  TEXT STARTS HERE=========================

SOURCE:  Digital Equipment Corporation  - ( DSIN / DSNlink FLASH MAIL )
         Software Security Response Team                             17.MAY.94

PRODUCT: ULTRIX        Versions 4.3, 4.3A, V4.4
         DECnet-ULTRIX Version 4.2
         DEC OSF/1     Versions 1.2, 1.3, 1.3A, 2.0

ADVISORY INFORMATION:

SUBJECT:  Security Enhanced Kit for DECNET-ULTRIX V4.2, ULTRIX V4.3 (VAX/RISC),
          ULTRIX V4.3A (RISC), ULTRIX V4.4 (VAX/RISC),
          ULTRIX Worksystem Software and DEC OSF/1 V1.2 - V2.0

IMPACT:   Potential security vulnerabilities exist where, under certain
          circumstances user access or privilege may be expanded.

SOLUTION: ULTRIX: Upgrade/Install ULTRIX to an minimum of V4.4 and install the
          Security Enhanced Kit

          DEC OSF/1: Upgrade/Install to a minimum of V1.2 and install
          the Security Enhanced Kit
          [Note: In the text below, Digital identifies OSF/1 V2.0 as the
          minimum. Digital has confirmed that 2.0 is correct. --CERT staff]

_______________________________________________________________________________
These kits are available from Digital Equipment Corporation by contacting your
normal Digital support channel or by request via DSNlink for electronic
transfer.
_______________________________________________________________________________

IMPACT:

Digital has discovered the existence of potential security vulnerabilities in
the ULTRIX V4.3, V4.3a, V4.4 and DEC OSF/1 V1.2, V1.3, V2.0 Operating Systems,
and DECnet-ULTRIX V4.2.  These potential vulnerabilities were discovered as a
result of evaluating recent reports of potential security vulnerabilities
which were distributed on the INTERNET and as a result of Digital's continued
engineering efforts.  The solutions to these vulnerabilities have been
included in the next release of ULTRIX and DEC OSF/1.

The kits have been created to correct potential security vulnerabilities
which, under certain circumstances may expand user access or privilege.

Digital Equipment Corporation strongly urges Customers to upgrade to a
minimum of ULTRIX V4.4 and DEC OSF/1 V2.0 then apply the Security Enhanced
Kit.  
        - Please refer to the applicable Release Note information prior to
          upgrading your installation.

_______________________________________________________________________________
KIT PART NUMBERS and DESCRIPTIONS

CSC PATCH #

CSCPAT_4060  V1.0   ULTRIX    V4.3 thru V4.4  (Includes DECnet-ULTRIX V4.2)
CSCPAT_4061  V1.0   DEC OSF/1 V1.2 thru V2.0

         _______________________________________________________________
         These kits will not install on versions previous to ULTRIX V4.3
         or DEC OSF/1 V1.2.
         _______________________________________________________________

_______________________________________________________________________________
_______________________________________________________________________________
The ULTRIX Security Enhanced kit replaces the following images:

/usr/etc/comsat                 ULTRIX V4.3, V4.3a, V4.4
/usr/ucb/lpr                    "                      "
/usr/bin/mail                   "                      "
/usr/lib/sendmail               "                      "

/usr/etc/telnetd                ULTRIX V4.3, V4.3a only

______________________________________
for DECnet-ULTRIX V4.2  installations:

/usr/etc/dlogind
/usr/etc/telnetd.gw
                *sendmail - is a previously distributed solution.

_______________________________________________________________________________
The DEC OSF/1 Security Enhanced kit replaces the following images:

/usr/sbin/comsat                DEC OSF/1 V1.2, V1.3 V2.0
/usr/bin/binmail
/usr/bin/lpr                    "                       "

/usr/sbin/sendmail              DEC OSF/1 V1.2, V1.3  only
/usr/bin/rdist                  "                       "
/usr/shlib/libsecurity.so       DEC OSF/1 V2.0 only
                *sendmail - is a previously distributed solution.
_______________________________________________________________________________

Digital urges you to periodically review your system management and
security procedures.  Digital will continue to review and enhance the
security features of its products and work with customers to maintain
and improve the security and integrity of their systems.
_______________________________________________________________________________

    NOTE: For non-contract/non-warranty customers contact your local Digital
          support channels for information regarding these kits.
______________________________________________________________________________

======================FORWARDED TEXT ENDS HERE===============================

CERT bulletins, CERT advisories, information about FIRST representatives,
and other information related to computer security are available for
anonymous FTP from info.cert.org.

If you wish to send sensitive incident or vulnerability information to
CERT staff by electronic mail, we strongly advise that the e-mail be
encrypted.  The CERT Coordination Center can support a shared DES key, PGP
(public key available via anonymous FTP on info.cert.org), or PEM (contact
CERT staff for details).

Internet E-mail: cert at cert.org
Telephone: +1 412-268-7090 (24-hour hotline)
           CERT personnel answer 8:30 a.m.-5:00 p.m. EST(GMT-5)/EDT(GMT-4),
           and are on call for emergencies during other hours.
Fax: +1 412-268-6989

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213-3890
USA

CERT is a service mark of Carnegie Mellon University.