265 lines
11 KiB
Plaintext
265 lines
11 KiB
Plaintext
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
|
|
/* *\
|
|
/ * * \
|
|
/ * * \
|
|
/ * * \
|
|
/ * System Vulnerabilities * \
|
|
| * * |
|
|
| * * |
|
|
| * * |
|
|
| * Another Modernz Presentation * |
|
|
| * * |
|
|
\ * by * /
|
|
\ * Multiphage * /
|
|
\ * * /
|
|
\ * (C)opyright June 9th, 1992 * /
|
|
\ * */
|
|
*********************************************************
|
|
|
|
|
|
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
|
|
*******************************************************************************
|
|
The Modernz can be contacted at:
|
|
|
|
MATRIX BBS
|
|
WOK-NOW!
|
|
World of Kaos NOW!
|
|
World of Knowledge NOW!
|
|
St. Dismis Institute
|
|
- Sysops: Wintermute
|
|
Digital-demon
|
|
(908) 905-6691
|
|
(908) WOK-NOW!
|
|
(908) 458-xxxx
|
|
1200/2400/4800/9600
|
|
14400/19200/38400
|
|
Home of Modernz Text Philez
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
|
|
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
|
|
|
|
TANSTAAFL
|
|
Pheonix Modernz
|
|
The Church of Rodney
|
|
- Sysop: Tal Meta
|
|
(908) 830-TANJ
|
|
(908) 830-8265
|
|
Home of TANJ Text Philez
|
|
|
|
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
|
|
|
|
CyberChat
|
|
Sysop: Hegz
|
|
(908)506-6651
|
|
(908)506-7637
|
|
300/1200/2400/4800/9600
|
|
14400/19200/38400
|
|
Modernz Site
|
|
TLS HQ
|
|
|
|
<><><><><><><><><><><><><><<><<><><><><><><><><><><><><><><><><><><><><><><><><
|
|
|
|
The Global Intelligence Center
|
|
World UASI Headquarters!
|
|
Pennsylvania SANsite!
|
|
(412) 475-4969 300/1200/2400/9600
|
|
24 Hours! SysOp: The Road Warrior
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
|
|
|
|
The Lost Realm
|
|
Western PA UASI site!
|
|
Western PA. SANfranchise
|
|
(412) 588-5056 300/1200/2400
|
|
SysOp: Orion Buster
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
|
|
|
|
The Last Outpost
|
|
PowerBBS Support Board
|
|
UASI ALPHA Division
|
|
NorthWestern PA UASI site!
|
|
(412) 662-0769 300/1200/2400
|
|
24 hours! SysOp: The Almighty Kilroy
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
|
|
|
|
Hellfire BBS
|
|
SANctuary World Headquarters!
|
|
New Jersey UASI site!
|
|
(908) 495-3926 300/1200/2400
|
|
24 hours! SysOp: Red
|
|
|
|
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
|
|
|
|
BlitzKreig BBS
|
|
Home of TAP
|
|
(502)499-8933
|
|
|
|
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
|
|
|
|
|
|
|
|
|
|
IBM is aware of this problem and a fix is available as apar number "ix22628".
|
|
This patch is available for all AIX releases from "GOLD" to the current
|
|
release.
|
|
|
|
NOTE: THIS IS AN UPDATED PATCH FROM ONE RECENTLY MADE AVAILABLE and fixes
|
|
a security hole in the original patch. The SCCS id of the correct patch
|
|
is tftpd.c 1.13.1.3 (*not* 1.13.1.2 or earlier versions). This can be
|
|
checked using the following "what" command.
|
|
.More..
|
|
|
|
% what /etc/tftpd
|
|
/etc/tftpd:
|
|
56 1.13.1.3 tftpd.c, tcpip, tcpip312 10/10/91 09:01:48
|
|
tftpsubs.c 1.2 com/sockcmd/tftpd,3.1.2,9048312 10/8/89 17:40:55
|
|
|
|
IBM customers may call IBM Support (800-237-5511) and ask that the fix
|
|
be shipped to them. The fix will appear in the upcoming 2009 update
|
|
and the next release of AIX.
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
I. Description
|
|
|
|
Previous versions of tftpd did not provide a method for restricting
|
|
TFTP access.
|
|
|
|
II. Impact
|
|
|
|
If TFTP is enabled at your site, anyone on the Internet can retrieve
|
|
copies of your site's world-readable files, such as /etc/passwd.
|
|
|
|
III. Solution
|
|
|
|
A. Sites that do not need to allow tftp access should disable it.
|
|
This can be done by editing /etc/inetd.conf and deleting or
|
|
commenting out the tftpd line:
|
|
|
|
#tftp dgram udp wait nobody /etc/tftpd tftpd -n
|
|
|
|
and then, as root, restarting inetd with the "refresh" command.
|
|
|
|
# refresh -s inetd
|
|
|
|
For more details on starting/stopping tftp, refer to documentation
|
|
for the System Resource Controller (SRC) or the System Management
|
|
Interface Tool (SMIT).
|
|
|
|
B. Sites that must run tftpd (for example, to support X terminals)
|
|
should obtain and install the above patch AND create a
|
|
/etc/tftpaccess.ctl file to restrict the files that are accessible.
|
|
The /etc/tftpaccess.ctl file should be writable only by root.
|
|
Although the new /etc/tftpaccess.ctl mechanism provides a very general
|
|
capability, the CERT/CC strongly recommends that sites keep this
|
|
control file simple. For example, the following tftpaccess.ctl file
|
|
is all that is necessary to support IBM X terminals:
|
|
|
|
# /etc/tftpaccess.ctl
|
|
# By default, all files are restricted if /etc/tftpaccess.ctl exists.
|
|
# Allow access to X terminal files.
|
|
allow:/usr/lpp/x_st_mgr/bin
|
|
|
|
NOTE: Be CERTAIN to create the /etc/tftpaccess.ctl file.
|
|
If it does not exist then all world-readable files are accessible
|
|
as in the current version of tftpd.
|
|
|
|
Installation Instructions:
|
|
|
|
1. Create an appropriate /etc/tftpaccess.ctl file.
|
|
|
|
2. From the directory containing the new tftpd module, issue
|
|
the following commands as root.
|
|
|
|
# chmod 644 /etc/tftpaccess.ctl
|
|
# chown root.system /etc/tftpaccess.ctl
|
|
# mv /etc/tftpd /etc/tftpd.old
|
|
# cp tftpd /etc
|
|
# chmod 755 /etc/tftpd
|
|
# chown root.system /etc/tftpd
|
|
# refresh -s inetd
|
|
|
|
===========================================================================
|
|
|
|
|
|
/usr/ucb/rdist Vulnerability
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
Information concerning a vulnerability in /usr/ucb/rdist (the location of
|
|
rdist may vary depending on the operating system). This vulnerability is
|
|
present in possibly all versions of rdist. Vendors responding with patches
|
|
are listed below. Additionally, some vendors who do not include rdist in
|
|
their operating systems are identified. Operating systems from vendors not
|
|
listed in either of the two categories below will probably be affected and
|
|
the CERT/CC has proposed a workaround for those systems.
|
|
|
|
VENDORS THAT DO NOT SHIP rdist
|
|
(Note: Even though these vendors do not ship rdist, it may have been
|
|
added later (for example, by the system administrator). It is
|
|
also possible that vendors porting one of these operating systems
|
|
may have added rdist. In both cases corrective action must be taken.)
|
|
|
|
Amdahl
|
|
AT&T System V
|
|
Data General DG/UX for AViiON Systems
|
|
|
|
|
|
VENDORS PROVIDING PATCHES
|
|
|
|
Cray Research, Inc. UNICOS 6.0/6.E/6.1 Field Alert #132 SPR 47600
|
|
|
|
For further information contact the Support Center at 1-800-950-CRAY or
|
|
612-683-5600 or e-mail support@crayamid.cray.com.
|
|
|
|
NeXT Computer, Inc. NeXTstep Release 2.x
|
|
|
|
A new version of rdist may be obtained from your
|
|
authorized NeXT Support Center. If you are an authorized
|
|
support center, please contact NeXT through your normal
|
|
channels. NeXT also plans to make this new version of
|
|
rdist available on the public NeXT FTP archives.
|
|
|
|
Silicon Graphics IRIX 3.3.x/4.0 (fixed in 4.0.1)
|
|
|
|
Patches may be obtained via anonymous ftp from sgi.com in the
|
|
sgi/rdist directory.
|
|
|
|
Sun Microsystems, Inc. SunOS 4.0.3/4.1/4.1.1 Patch ID 100383-02
|
|
|
|
Patches may be obtained via anonymous ftp from ftp.uu.net or from local
|
|
Sun Answer Centers worldwide.
|
|
|
|
|
|
All trademarks are the property of their respective holders.
|
|
---------------------------------------------------------------------------
|
|
|
|
I. Description
|
|
|
|
A security vulnerability exists in /usr/ucb/rdist that
|
|
can be used to gain unauthorized privileges. Under some
|
|
circumstances /usr/ucb/rdist can be used to create setuid
|
|
root programs.
|
|
|
|
II. Impact
|
|
|
|
Any user logged into the system can gain root access.
|
|
|
|
III. Solution
|
|
|
|
A. If available, install the appropriate patch provided by
|
|
your operating system vendor.
|
|
|
|
B. If no patch is available, restrict the use of /usr/ucb/rdist
|
|
by changing the permissions on the file.
|
|
|
|
# chmod 711 /usr/ucb/rdist
|
|
|