- NANOG - lists.nanog.org

CERFnet Weekly Report for the week of Monday, May 25, 1992
by Donna Bigley 01 Jun '92

01 Jun '92

############################################################################### This is the CERFnet weekly activity report for the period of Monday, May 25th through Sunday, May 31th, 1992. This report is also available through anonymous FTP from NIC.CERF.NET [192.102.249.3] in the cerfnet/cerfnet_stats subdirectory. The filename is: 31-May-92.txt All times are in Pacific Standard Time, and in the 24-hour format. Please direct any questions or comments to: donnab(a)cerf.net or help(a)cerf.net ****************************************************************************** NETWORK OUTAGES: TICKET #: 1006 SITE: UCSB-UCLA SITES AFFECTED: UCSB-UCLA TIME STARTED: TUE. 05-26-92 07:30 TIME ENDED: TUE. 05-26-92 09:15 TIME ELAPSED: 1 hour 45 minutes REASON: Link Failure TICKET #: 1010 SITE: UCI-SDSC T1 SITES AFFECTED: UCI-SDSC T1 TIME STARTED: WED. 05-27-92 02:42 TIME ENDED: WED. 05-27-92 04:27 TIME ELAPSED: 1 hour 45 minutes REASON: Vendor Scheduled Maintenance TICKET #: 1011 SITE: EMULEX-UCI SITES AFFECTED: EMULEX-UCI TIME STARTED: WED. 05-27-92 04:17 TIME ENDED: WED. 05-27-92 05:53 TIME ELAPSED: 1 hour 36 minutes (Intermittent Access) REASON: Equipment Trouble TICKET #: 1012 SITE: CICESE SITES AFFECTED: CICESE TIME STARTED: FRI. 05-29-92 01:45 TIME ENDED: FRI. 05-29-92 02:00 TIME STARTED: FRI. 05-29-92 02:43 TIME ENDED: FRI. 05-29-92 03:24 TIME ELAPSED: 56 minutes (Intermittent Access) REASON: Site Scheduled Maintenance TICKET #: 1013 SITE: EMULEX-UCI SITES AFFECTED: EMULEX-UCI TIME STARTED: FRI. 05-29-92 18:59 TIME ENDED: FRI. 05-29-92 19:25 TIME STARTED: SAT. 05-30-92 21:11 TIME ENDED: SAT. 05-30-92 19:25 TIME ELAPSED: 1 hour 56 minutes (Intermittent Access) REASON: Unknown ------------------------------------------------------------------------ NETWORK ACTIVITY: SDG&E will become a new CERF56 member on Tuesday, June 2nd, 1992. ------------------------------------------------------------------------ CERFNET TRAFFIC CAPACITY USAGE AT EACH CIRCUIT LINK LINK SPEED CAPACITY PEAK HOUR (PDT) UCI/CALTECH 45.000 mbps No capacities available this week. SDSC/CALTECH 1.544 mbps 08.7% 11:00 SDSC/UCI 1.544 mbps 08.0% 09:00 SDSC/UCLA 1.544 mbps 05.3% 14:00 SDSC/UCOP 1.544 mbps 03.1% 10:00 UCI/UCLA 1.544 mbps No capacities available this week. SDSC/UCR 512 kbps 03.3% 13:00 UCLA/UCSB 512 kbps 06.1% 15:00 SDSC/AGI 1.544 mbps 00.4% 19:00 SDSC/BIOSYM 1.544 mbps 00.3% 09:00 SDSC/GD 1.544 mbps 01.3% 07:00 SDSC/SAIC 1.544 mbps 00.8% 15:00 SDSC/SCAQMD 1.544 mbps 00.1% 15:00 UCI/CSU CO(SWRL) 1.544 mbps 02.7% 13:00 UCOP/APPLE 1.544 mbps 00.9% 15:00 UCOP/CISCO 1.544 mbps 00.1% 08:00 UCR/LLUMC 1.544 mbps 00.2% 20:00 CALTECH/CADAM 56 kbps 00.4% 15:00 CALTECH/CITY OF HOPE 56 kbps 00.3% 17:00 CALTECH/CLAREMONT 56 kbps 20.6% 11:00 CALTECH/DISNEY 56 kbps 03.8% 17:00 CALTECH/OXY 56 kbps 08.1% 17:00 SDSC/AJS 56 kbps 01.5% 17:00 SDSC/KOREA 56 kbps 09.3% 00:00 SDSC/QUALCOMM 56 kbps 08.0% 09:00 SDSC/SCIH 56 kbps 02.9% 09:00 SDSC/USD 56 kbps 04.3% 09:00 SDSC/USIU 56 kbps 00.6% 15:00 SDSC/XEROX 56 kbps 00.4% 02:00 UCI/CMD 56 kbps No capacities available this week. UCI/EMULEX 56 kbps 02.2% 14:00 UCI/FULLERTON 56 kbps 01.7% 16:00 UCI/HUGHES 56 kbps 13.1% 09:00 UCI/MTI 56 kbps 05.2% 14:00 UCI/SPARTA 56 kbps 03.2% 13:00 UCI/UNOCAL 56 kbps 08.8% 13:00 UCLA/ISX 56 kbps 02.1% 17:00 UCLA/PEPPERDINE 56 kbps 01.5% 08:00 UCLA/QUOTRON 56 kbps 08.7% 21:00 UCLA/SMC 56 kbps 02.8% 10:00 UCOP/FARALLON 56 kbps 04.1% 12:00 UCOP/INTEL 56 kbps 12.7% 09:00 UCOP/LSIL 56 kbps 08.8% 21:00 UCOP/NETLABS 56 kbps 15.8% 19:00 ------------------------------------------------------------------------------ SITE CISCO BOX UPTIME SINCE LAST REBOOT (as of 00:15 PST on Jun. 1, 1992): CERFnet BACKBONE CALTECH [131.215.139.253] Up: 13 days 14 hours 02 minutes SDSC LongBoard [134.24.99.254] Up: 04 days 01 hours 53 minutes [Equipment Trouble] SDSC Drzog [132.249.16.13] Up: 18 days 14 hours 24 minutes SDSC Hang10 [132.249.16.15] Up: 18 days 14 hours 24 minutes UCI [128.200.1.101] Up: 32 days 16 hours 04 minutes UCLA [128.97.130.10] Up: 56 days 06 hours 28 minutes UCOP [134.24.52.112] Up: 68 days 16 hours 38 minutes UCR [134.24.108.105] Up: 71 days 06 hours 48 minutes CERF 1544 AGI [134.24.202.110] Up: 108 days 13 hours 54 minutes APPLE [134.24.70.200] Up: 217 days 06 hours 15 minutes BIOSYM [134.24.57.200] Up: 03 days 12 hours 23 minutes [Unscheduled Site Maintenance] CISCO Systems [134.24.54.200] Up: 10 days 10 hours 16 minutes CSUCO/SWRL [130.150.102.200] Up: 37 days 18 hours 08 minutes GA [134.24.221.200] Up: 06 days 08 hours 38 minutes [Site Scheduled Maintenance] GD [134.24.60.200] Up: 31 days 16 hours 18 minutes LLUMC [134.24.208.200] Up: 194 days 12 hours 02 minutes MCD [134.24.65.200] Up: 103 days 09 hours 50 minutes SAIC [134.24.53.208] Up: 18 days 14 hours 10 minutes SCAQMD [134.24.234.200] Up: 164 days 14 hours 27 minutes SDSU [192.77.100.101] Up: 17 days 16 hours 29 minutes UCSB [134.24.107.107] Up: 194 days 07 hours 38 minutes CERF 56 AJS [134.24.225.101] Up: 135 days 14 hours 17 minutes CADAM [134.24.229.200] Up: 117 days 13 hours 01 minutes CICESE [134.24.227.200] Up: 12 days 09 hours 44 minutes CITY_OF_HOPE [134.24.233.200] Up: 12 days 13 hours 48 minutes CLAREMONT [134.24.206.109] Up: 65 days 17 hours 39 minutes CMD [134.24.218.200] Up: 125 days 13 hours 14 minutes DATAPRODUCTS [134.24.211.104] Up: 61 days 09 hours 33 minutes DISNEY [134.24.207.211] Up: 51 days 10 hours 00 minutes EMULEX [134.24.209.212] Up: 50 days 12 hours 12 minutes FARALLON [134.24.56.200] Up: 01 days 08 hours 22 minutes [Unknown] FULLERTON [134.24.214.217] Up: 13 days 21 hours 03 minutes GTE [134.24.212.200] Up: 77 days 16 hours 57 minutes HUGHES [134.24.204.200] Up: 40 days 10 hours 48 minutes INTEL [134.24.73.200] Up: 64 days 11 hours 34 minutes LSIL [134.24.72.200] Up: 26 days 08 hours 26 minutes MTI [134.24.216.100] Up: 36 days 09 hours 34 minutes NETLABS [134.24.71.200] Up: 67 days 08 hours 51 minutes OXY [134.24.205.108] Up: 55 days 16 hours 27 minutes PEPPERDINE [134.24.203.218] Up: 51 days 21 hours 42 minutes QUALCOMM [134.24.200.201] Up: 21 days 00 hours 52 minutes QUOTRON [134.24.230.202] Up: 16 days 06 hours 29 minutes SANTA MONICA [134.24.210.219] Up: 33 days 06 hours 29 minutes SCI-HOR [134.24.109.205] Up: 19 days 06 hours 02 minutes SEASPACE [134.24.80.200] Up: 53 days 11 hours 26 minutes SERI/KOREA [134.24.223.200] Up: 55 days 00 hours 40 minutes SPARTA [134.24.215.200] Up: 62 days 10 hours 57 minutes UNOCAL [134.24.217.200] Up: 87 days 01 hours 57 minutes USD [134.24.201.106] Up: 22 days 02 hours 56 minutes USIU [134.24.222.215] Up: 330 days 17 hours 07 minutes XEROX [134.24.51.207] Up: 214 days 23 hours 22 minutes DIAL n' CERF DNC-SDSC [134.24.1.2] Up: 18 days 14 hours 31 minutes DNC-UCI [134.24.2.2] Up: 32 days 15 hours 58 minutes DNC-UCLA [134.24.3.2] Up: 56 days 06 hours 25 minutes DNC-CALTECH [134.24.4.2] Up: 64 days 05 hours 42 minutes DNC-UCOP [134.24.5.2] Up: 18 days 14 hours 23 minutes SDSC-NETBLAZER [192.102.249.25] Up: 18 days 14 hours 28 minutes UCLA-NETBLAZER [134.24.93.2] Up: 09 days 12 hours 21 minutes

1 0

Additions to the NSFNET policy-based routing database
by Belinda Sue Blair 29 May '92

29 May '92

The following networks have been added to the NSFNET policy-based routing database: T1 Network: ---------- Network IP: 129.198 Network Name: ELAN Location: Air Force Flight Test Center, Directorate of Communications and Computer Systems, Building 2850, Room 14, Edwards Air Force Base, CA 93523-5000 USA Country Code: US 1:164 Milnet (FIX-West) 2:184 Milnet (FIX-East) Network IP: 137.176 Network Name: PGXPRESS-1 Location: Procter & Gamble Company, 1 Procter & Gamble Plaza, Cincinnati, OH 45202-3315, USA Country Code: US 1:750 T1-T3 Network Interconnect (Ann Arbor, MI) 2:756 T1-T3 Network Interconnect (Princeton, NJ) 10:266 CICNET at MERIT 11:267 CICNET at UIUC Network IP: 143.93 Network Name: RZAK-LAN Location: Fachhochschule Rheinland-Pfalz, Abteilung Kaiserslautern, Morlauterer Strasse 31, D-W-6750 Kaiserslautern, GERMANY Country Code: DE 1:701 Alternet 2:1800 ICM-FIX-E 3:1238 ICM-NORDUNET Network IP: 152.74 Network Name: UDEC-CHILE Location: Universidad de Concepcion, Division de Informatica, PO Box 1313, Concepcion, CHILE Country Code: CL 1:86 SURANET Regional Network (College Park) 2:279 SURANET Regional Network (Georgia Tech) 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 158.182 Network Name: HKBCNET Location: Computer Center, Hong Kong Baptist College, CTSC, 224 Waterloo Road, Kowloong, HONG KONG Country Code: HK 1:372 Nasa Science Network (FIX-West) 2:297 Nasa Science Network (FIX-East) 12:754 T1-T3 Network Interconnect (Houston, TX) 13:751 T1-T3 Network Interconnect (San Diego, CA) Network IP: 192.26.174 Network Name: UP-NETS Location: University of Paderborn, Warburger Strasse 100, D-W-4790 Paderborn, GERMANY Country Code: DE 1:293 Energy Science Network (FIX-East) 2:291 Energy Science Network (FIX-West) Network IP: 192.112.24 Network Name: SAUELD Location: Southern Arkansas University, El Dorado Branch, 300 South West Avenue, El Dorado, AR 71730, USA Country Code: US 1:93 Midnet 12:754 T1-T3 Network Interconnect (Houston, TX) 13:751 T1-T3 Network Interconnect (San Diego, CA) Network IP: 192.124.132 Network Name: WEC-BIB Location: WestingHouse Electric Corp, S1622, PO Box 746, Baltimore, MD 21203 USA Country Code: US 1:701 Alternet 2:702 Alternet 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.138.221 Network Name: KURZ-NET Location: Kurzweil Applied Intelligence,Inc., 10 Moulton Street, Cambridge, MA 02138, USA Country Code: US 1:1384 NEARnet Regional Network 2:1383 NEARnet Regional Network 3:560 NEARnet Regional Network 4:281 NEARnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) 20:701 Alternet Network IP: 192.138.222 Network Name: KURZNET1 Location: Kurzweil Applied Intelligence,Inc., 10 Moulton Street, Cambridge, MA 02138, USA Country Code: US 1:1384 NEARnet Regional Network 2:1383 NEARnet Regional Network 3:560 NEARnet Regional Network 4:281 NEARnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) 20:701 Alternet Network IP: 192.138.223 Network Name: KURZ-net2 Location: Kurzweil Applied Intelligence,Inc., 10 Moulton Street, Cambridge, MA 02138, USA Country Code: US 1:1384 NEARnet Regional Network 2:1383 NEARnet Regional Network 3:560 NEARnet Regional Network 4:281 NEARnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) 20:701 Alternet Network IP: 192.138.224 Network Name: KURZ-NET3 Location: Kurzweil Applied Intelligence,Inc., 10 Moulton Street, Cambridge, MA 02138, USA Country Code: US 1:1384 NEARnet Regional Network 2:1383 NEARnet Regional Network 3:560 NEARnet Regional Network 4:281 NEARnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) 20:701 Alternet Network IP: 192.138.251 Network Name: GESNET Location: Massey University, 176 Te Awe Awe Street, Palmerston North, NEW ZEALAND Country Code: NZ 1:372 Nasa Science Network (FIX-West) 2:297 Nasa Science Network (FIX-East) 12:754 T1-T3 Network Interconnect (Houston, TX) 13:751 T1-T3 Network Interconnect (San Diego, CA) Network IP: 192.150.142 Network Name: PHIBRED Location: Pioneer Hi-Bred International, Inc., 7200 NW 62nd Avenue, P.O Box 184, Johnston, IA. 50131, USA Country Code: US 1:93 Midnet 12:754 T1-T3 Network Interconnect (Houston, TX) 13:751 T1-T3 Network Interconnect (San Diego, CA) Network IP: 192.154.16 Network Name: REUTERSG-1 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE 0511 Country Code: SG 1:97 JvNCnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.154.17 Network Name: REUTERSG-2 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE, 0511 Country Code: SG 1:97 JvNCnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.154.18 Network Name: REUTERSG-3 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE, 0511 Country Code: SG 1:97 JvNCnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.154.19 Network Name: REUTERSG-4 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE, 0511 Country Code: SG 1:97 JvNCnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.154.20 Network Name: REUTERSG-5 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE, 0511 Country Code: SG 1:97 JvNCnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.154.21 Network Name: REUTERSG-6 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE, 0511 Country Code: SG 1:97 JvNCnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.154.25 Network Name: REUTERSG-10 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE, 0511 Country Code: SG 1:97 JvNCnet Regional Network 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.160.72 Network Name: CPHA-NET Location: Commission on Professional and Hospital Activities, 1105 Eisenhower Place, PO Box 304, Ann Arbor, MI 48106-0304, USA Country Code: US 1:174 NYSERNet Regional Network / PSI 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.160.128 Network Name: IFT-UE-ANSP Location: Instituto de Fisica Teorica, R. Pamplona, 145 CEP 01405 - Sao Paulo - BRAZIL Country Code: BR 1:291 Energy Science Network (FIX-West) 2:293 Energy Science Network (FIX-East) Total configured T1 networks: 5515 T3 Network: ---------- Network IP: 137.176 Network Name: PGXPRESS-1 Location: Procter & Gamble Company, 1 Procter & Gamble Plaza, Cincinnati, OH 45202-3315, USA Country Code: US 1:600 OARNET, Cleveland, OH 2:266 CICNET at MERIT 3:267 CICNET at UIUC Network IP: 152.74 Network Name: UDEC-CHILE Location: Universidad de Concepcion, Division de Informatica, PO Box 1313, Concepcion, CHILE Country Code: CL 1:86 SURANET Regional Network (College Park) 2:279 SURANET Regional Network (Georgia Tech) Network IP: 158.182 Network Name: HKBCNET Location: Computer Center, Hong Kong Baptist College, CTSC, 224 Waterloo Road, Kowloong, HONG KONG Country Code: HK 1:372 Nasa Science Network (FIX-West) 2:297 Nasa Science Network (FIX-East) Network IP: 192.112.26 Network Name: UAMONT Location: University of Arkansas at Monticello, P.O. Box 3626, Monticello, AR 71655, USA Country Code: US 1:93 ENSS 140, Lincoln, Nebraska Network IP: 192.124.132 Network Name: WEC-BIB Location: WestingHouse Electric Corp, S1622, PO Box 746, Baltimore, MD 21203 USA Country Code: US 42:702 Alternet 43:701 Alternet Network IP: 192.138.221 Network Name: KURZ-NET Location: Kurzweil Applied Intelligence,Inc., 10 Moulton Street, Cambridge, MA 02138, USA Country Code: US 1:560 NEARnet Regional Network 2:281 NEARnet Regional Network Network IP: 192.138.222 Network Name: KURZ-NET1 Location: Kurzweil Applied Intelligence,Inc., 10 Moulton Street, Cambridge, MA 02138, USA Country Code: US 1:560 NEARnet Regional Network 2:281 NEARnet Regional Network Network IP: 192.138.223 Network Name: KURZ-NET2 Location: Kurzweil Applied Intelligence,Inc., 10 Moulton Street, Cambridge, MA 02138, USA Country Code: US 1:560 NEARnet Regional Network 2:281 NEARnet Regional Network Network IP: 192.138.224 Network Name: KURZ-NET3 Location: Kurzweil Applied Intelligence,Inc., 10 Moulton Street, Cambridge, MA 02138, USA Country Code: US 1:560 NEARnet Regional Network 2:281 NEARnet Regional Network Network IP: 192.138.251 Network Name: GESNET Location: Massey University, 176 Te Awe Awe Street, Palmerston North, NEW ZEALAND Country Code: NZ 1:372 Nasa Science Network (FIX-West) 2:297 Nasa Science Network (FIX-East) Network IP: 192.150.142 Network Name: PHIBRED Location: Pioneer Hi-Bred International, Inc., 7200 NW 62nd Avenue, P.O Box 184, Johnston, IA 50131, USA Country Code: US 1:93 ENSS 140, Lincoln, Nebraska Network IP: 192.154.16 Network Name: REUTERSG-1 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE 0511 Country Code: SG 1:97 ENSS 137 - Princeton Network IP: 192.154.17 Network Name: REUTERSG-2 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE 0511 Country Code: SG 1:97 ENSS 137 - Princeton Network IP: 192.154.18 Network Name: REUTERSG-3 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE 0511 Country Code: SG 1:97 ENSS 137 - Princeton Network IP: 192.154.19 Network Name: REUTERSG-4 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE 0511 Country Code: SG 1:97 ENSS 137 - Princeton Network IP: 192.154.20 Network Name: REUTERSG-5 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE 0511 Country Code: SG 1:97 ENSS 137 - Princeton Network IP: 192.154.21 Network Name: REUTERSG-6 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE 0511 Country Code: SG 1:97 ENSS 137 - Princeton Network IP: 192.154.25 Network Name: REUTERSG-10 Location: Reuters Singapore Pte Ltd, 16A, Science Park Drive, #04-02, The Pascal, SINGAPORE 0511 Country Code: SG 1:97 ENSS 137 - Princeton Total configured T3 networks: 3690 ***************************************************************** The configuration reports, map information sheets, and configuration files which reflect these changes are available for anonymous ftp on nis.nsf.net as usual. nsfnet/announced.networks - configuration reports latest report for: - NSFNET T1 has the file extension .now - NSFNET T3 has the file extension 3.now nsfnet/backbone.configuration - configuration files for the routing software for each NSS latest report for: - NSFNET T1 has the file format config.nss# - NSFNET T3 has the file extension .t3p Please send all requests for configuration changes to nsfnet-admin(a)merit.edu using the NSFNET configuration forms. The forms are available on-line. from the nis.nsf.net machine. Use ftp and the anonymous login to get on the machine. Do a "cd nsfnet/announced.networks" and get the files TEMPLATE.NET, TEMPLATE.GATE, and TEMPLATE.AS. ******************************* -Steve Widmayer Merit/NSFNET -B. Sue Blair Merit/NSFNET -Michael O'Neill Merit/NSFNET

1 0

CERT Advisory - REVISED SunOS rpc.mountd Vulnerability
by CERT Advisory 28 May '92

28 May '92

=========================================================================== CA-92:12 CERT Advisory May 28, 1992 Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability --------------------------------------------------------------------------- *** THIS IS A REVISED CERT ADVISORY *** *** IT CONTAINS NEW VULNERABILITY AND PATCH INFORMATION *** *** SUPERSEDES CERT ADVISORY CA-91:09 *** The Computer Emergency Response Team/Coordination Center (CERT/CC) has received information concerning the availability of a revised security patch for /usr/etc/rpc.mountd in Sun Microsystems Computer Corporation operating systems. This patch fixes an additional vulnerability that was not addressed in CERT advisory CA-91:09.SunOS.rpc.mountd.vulnerability. Sun has provided patches for SunOS 4.1, SunOS 4.1_PSR_A, SunOS 4.1.1, and SunOS 4.1.2. These patches are available through your local Sun Answer Center as well as through anonymous ftp from ftp.uu.net (137.39.1.9) in the /systems/sun/sun-dist directory. Patch ID and file information are as follows: Fix Patch ID Filename Checksum /usr/etc/rpc.mountd 100296-02 100296-02.tar.Z 30606 23 Please note that Sun Microsystems sometimes updates patch files. If you find that the checksum is different, please contact Sun Microsystems or the CERT/CC for verification. --------------------------------------------------------------------------- I. Description Under certain conditions an exported NFS filesystem can be mounted by any system on the Internet even though it may appear that access to the filesystem is restricted to specific hosts. II. Impact Unauthorized remote hosts will be able to mount the exported filesystem. III. Solution As root: 1. Move the existing rpc.mountd aside and change the permissions. # mv /usr/etc/rpc.mountd /usr/etc/rpc.mountd.OLD # chmod 400 /usr/etc/rpc.mountd.OLD 2. Install the new version # cp `arch`/rpc.mountd /usr/etc # chown root.staff /usr/etc/rpc.mountd # chmod 755 /usr/etc/rpc.mountd 3. Kill the currently running rpc.mountd and restart it, or reboot the system. In either case, systems with filesystems mounted from this host will have interruptions in service. --------------------------------------------------------------------------- If you believe that your system has been compromised, contact CERT/CC or your representative in FIRST (Forum of Incident Response and Security Teams). Internet E-mail: cert(a)cert.org Telephone: 412-268-7090 (24-hour hotline) CERT/CC personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4), on call for emergencies during other hours. Computer Emergency Response Team/Coordination Center (CERT/CC) Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 Past advisories, information about FIRST representatives, and other information related to computer security are available for anonymous ftp from cert.org (192.88.209.5).

1 0

Additions to the NSFNET policy-based routing database
by Riaz Taherzadeh-Yazdian 28 May '92

28 May '92

The following networks have been added to the NSFNET policy-based routing database: T1 Network: ---------- Network IP: 145.24 Network Name: HRONET Location: Hogeschool Rotterdam & Omstreken, Rochussenstraat 125, 3015 EJ Rotterdam, NETHERLANDS Country Code: NL 1:590 EASInet Regional Network 2:1800 ICM-FIX-E 3:1238 ICM-NORDUNET Network IP: 161.44 Network Name: TGV-NETB Location: TGV, Inc., 603 Mission Street, Santa Cruz, CA, 95060, USA Country Code: US 1:200 BARRNET Regional Network 2:201 BARRNet Regional Network 12:754 T1-T3 Network Interconnect (Houston, TX) 13:751 T1-T3 Network Interconnect (San Diego, CA) Network IP: 192.6.78 Network Name: HP-CUP Location: Hewlett-Packard Company, 19420 Homestead Road, Cupertino, CA 95014, USA Country Code: US 1:174 NYSERNet Regional Network / PSI 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.6.130 Network Name: HP-CPC Location: Hewlett-Packard Company, 19420 Homestead Road, Cupertino, CA 95014, USA Country Code: US 1:174 NYSERNet Regional Network / PSI 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.42.127 Network Name: SWIDOC Location: Sociaal Wetenschappelijk Informatie en Documentatie Centrum, Herengracht 410-412; NL-1017 BX Amsterdam, NETHERLANDS Country Code: NL 1:590 EASInet Regional Network 2:1800 ICM-FIX-E 3:1238 ICM-NORDUNET Network IP: 192.63.74 Network Name: UNISYS-CNET2-374 Location: UNISYS, Route 22 and Werner Way, Lebanon, NJ, 08833, USA Country Code: US 1:174 NYSERNet Regional Network / PSI 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Network IP: 192.87.49 Network Name: ROB-IPNET Location: Rijksdienst voor het Oudheidkundig Bodemonderzoek, Kerkstraat 1; NL-3811 CV Amersfoort, THE NETHERLANDS Country Code: NL 1:590 EASInet Regional Network 2:1800 ICM-FIX-E 3:1238 ICM-NORDUNET Network IP: 192.112.24 Network Name: SAUELD Location: Southern Arkansas University, El Dorado Branch, 300 South West Avenue, El Dorado, AR 71730, USA Country Code: US 1:93 Midnet 12:754 T1-T3 Network Interconnect (Houston, TX) 13:751 T1-T3 Network Interconnect (San Diego, CA) Network IP: 192.153.56 Network Name: NETCOM15 Location: Netcom On-Line Communications, 4000 Moorpark Ave., Suite 209, San Jose, CA 95117, USA Country Code: US 1:200 BARRNET Regional Network 2:201 BARRNet Regional Network 12:754 T1-T3 Network Interconnect (Houston, TX) 13:751 T1-T3 Network Interconnect (San Diego, CA) Network IP: 192.160.72 Network Name: CPHA-NET Location: Commission on Professional and Hospital Activities, 1105 Eisenhower Place, PO Box 304, Ann Arbor, MI 48106-0304, USA Country Code: US 1:174 NYSERNet Regional Network / PSI 10:750 T1-T3 Network Interconnect (Ann Arbor, MI) 11:756 T1-T3 Network Interconnect (Princeton, NJ) Total configured T1 networks: 5494 T3 Network: ---------- Network IP: 161.44 Network Name: TGV-NETB Location: TGV, Inc., 603 Mission Street, Santa Cruz, CA, 95060, USA Country Code: US 1:200 BARRNet 2:201 BARRNet Network IP: 192.6.78 Network Name: HP-CUP Location: Hewlett-Packard Company, 19420 Homestead Road, Cupertino, CA 95014, USA Country Code: US 1:174 NYSERNet Regional Network / PSI Network IP: 192.6.130 Network Name: HP-CPC Location: Hewlett-Packard Company, 19420 Homestead Road, Cupertino, CA 95014, USA Country Code: US 1:174 NYSERNet Regional Network / PSI Network IP: 192.63.74 Network Name: UNISYS-CNET2-374 Location: UNISYS, Route 22 and Werner Way, Lebanon, NJ, 08833, USA Country Code: US 1:174 NYSERNet Regional Network / PSI Network IP: 192.112.26 Network Name: UAMONT Location: University of Arkansas at Monticello, P.O. Box 3626, Monticello, AR 71655, USA Country Code: US 1:93 ENSS 140, Lincoln, Nebraska Network IP: 192.153.56 Network Name: NETCOM15 Location: Netcom On-Line Communications, 4000 Moorpark Ave., Suite 209, San Jose, CA 95117, USA Country Code: US 1:200 BARRNet 2:201 BARRNet Network IP: 192.160.72 Network Name: CPHA-NET Location: Commission on Professional and Hospital Activities, 1105 Eisenhower Place, P.O. Box 304, Ann Arbor, MI 48106-0304, USA Country Code: US 1:174 NYSERNet Regional Network / PSI Total configured T3 networks: 3673 ***************************************************************** The configuration reports, map information sheets, and configuration files which reflect these changes are available for anonymous ftp on nis.nsf.net as usual. nsfnet/announced.networks - configuration reports latest report for: - NSFNET T1 has the file extension .now - NSFNET T3 has the file extension 3.now nsfnet/backbone.configuration - configuration files for the routing software for each NSS latest report for: - NSFNET T1 has the file format config.nss# - NSFNET T3 has the file extension .t3p Please send all requests for configuration changes to nsfnet-admin(a)merit.edu using the NSFNET configuration forms. The forms are available on-line. from the nis.nsf.net machine. Use ftp and the anonymous login to get on the machine. Do a "cd nsfnet/announced.networks" and get the files TEMPLATE.NET, TEMPLATE.GATE, and TEMPLATE.AS. ******************************* -B. Sue Blair Merit/NSFNET Michael J. O'Neill Merit/NSFNET Riaz Taherzadeh-Yazdian Merit/NSFNET

2 1

CERFnet Weekly Report for the week of Monday, May 18, 1992.
by Donna Bigley 27 May '92

27 May '92

############################################################################### This is the CERFnet weekly activity report for the period of Monday, May 18th through Sunday, May 24th, 1992. This report is also available through anonymous FTP from NIC.CERF.NET [192.102.249.3] in the cerfnet/cerfnet_stats subdirectory. The filename is: 24-may-92.txt All times are in Pacific Standard Time, and in the 24-hour format. Please direct any questions or comments to: donnab(a)cerf.net or help(a)cerf.net ****************************************************************************** NETWORK OUTAGES: TICKET #: 995 SITE: SERI/KOREA SITES AFFECTED: SERI/KOREA TIME STARTED: Mon 5-18-92 04:31 TIME ENDED: Mon 5-18-92 04:39 TIME ELAPSED: 8 minutes REASON: Link Failure TICKET #: 996 SITE: CICESE SITES AFFECTED: CICESE TIME STARTED: Mon 5-18-92 08:02 TIME ENDED: Mon 5-18-92 10:37 TIME ELAPSED: 2 hours 35 minutes REASON: Power Outage TICKET #: 990 SITE: CIT SITES AFFECTED: CIT, CIT Dial N' CERF, City Of Hope, OXY, Disney, Claremont, Cadam, and SCAQMD. TIME STARTED: Mon 5-18-92 09:49 TIME ENDED: Mon 5-18-92 10:14 TIME ELAPSED: 25 minutes REASON: Unknown TICKET #: 999 SITE: UCR-SDSC SITES AFFECTED: UCR-SDSC TIME STARTED: Tue 5-19-92 09:06 TIME ENDED: Tue 5-19-92 09:15 TIME ELAPSED: 9 minutes REASON: Unknown TICKET #: 983 SITE: UCLA-UCSB SITES AFFECTED: UCLA-UCSB TIME STARTED: Tue 5-19-92 09:07 TIME ENDED: Tue 5-19-92 09:11 TIME ELAPSED: 4 minutes REASON: Unknown TICKET #: 998 SITE: CICESE SITES AFFECTED: CICESE TIME STARTED: Tue 5-19-92 10:01 TIME ENDED: Tue 5-19-92 10:04 TIME STARTED: Tue 5-19-92 10:16 TIME ENDED: Tue 5-19-92 15:48 TIME ELAPSED: 5 hours 35 minutes (Intermittent Access) REASON: Power Outage TICKET #: 995 SITE: SERI/KOREA SITES AFFECTED: SERI/KOREA TIME STARTED: Wed 5-20-92 09:31 TIME ENDED: Wed 5-20-92 09:45 TIME STARTED: Wed 5-20-92 15:51 TIME ENDED: Wed 5-20-92 15:53 TIME STARTED: Wed 5-20-92 22:40 TIME ENDED: Wed 5-20-92 22:42 TIME ELAPSED: 18 minutes REASON: Link Failure TICKET #: 998 SITE: CICESE SITES AFFECTED: CICESE TIME STARTED: Wed 5-20-92 10:41 TIME ENDED: Wed 5-20-92 15:16 TIME ELAPSED: 4 hours 35 minutes (Intermittent Access) REASON: Site Scheduled Maintenance TICKET #: 1002 SITE: EMULEX SITES AFFECTED: EMULEX TIME STARTED: Thurs 5-21-92 02:21 TIME ENDED: Thurs 5-21-92 03:01 TIME ELAPSED: 40 minutes (Intermittent Access) REASON: Unknown TICKET #: 1000 SITE: CISCO SITES AFFECTED: CISCO TIME STARTED: Thurs 5-21-92 13:51 TIME ENDED: Thurs 5-21-92 14:22 TIME ELAPSED: 31 minutes REASON: CERFnet/Site Scheduled Maintenance TICKET #: 995 SITE: SERI/KOREA SITES AFFECTED: SERI/KOREA TIME STARTED: Fri. 5-22-92 01:12 TIME ENDED: Fri. 5-22-92 01:22 TIME ELAPSED: 10 min. REASON: Unknown TICKET #: 1003 SITE: UCLA-UCSB SITES AFFECTED: UCLA-UCSB TIME STARTED: Sun. 5-24-92 18:40 TIME ENDED: Mon. 5-25-92 08:04 TIME ELAPSED: 13 hours 24 min. REASON: Link Failure ------------------------------------------------------------------------ CERFNET TRAFFIC CAPACITY USAGE AT EACH CIRCUIT LINK LINK SPEED CAPACITY PEAK HOUR (PDT) UCI/CALTECH 45.000 mbps 00.1% 22:00 SDSC/CALTECH 1.544 mbps 08.0% 13:00 SDSC/UCI 1.544 mbps 08.8% 11:00 SDSC/UCLA 1.544 mbps 05.9% 14:00 SDSC/UCOP 1.544 mbps 03.0% 13:00 UCI/UCLA 1.544 mbps 08.8% 11:00 SDSC/UCR 512 kbps 03.6% 21:00 UCLA/UCSB 512 kbps 08.5% 14:00 SDSC/AGI 1.544 mbps 00.1% 18:00 SDSC/BIOSYM 1.544 mbps 00.1% 08:00 SDSC/GD 1.544 mbps 01.1% 12:00 SDSC/SAIC 1.544 mbps 00.7% 10:00 SDSC/SCAQMD 1.544 mbps 00.1% 12:00 UCI/CSU CO(SWRL) 1.544 mbps 03.4% 14:00 UCOP/APPLE 1.544 mbps 00.8% 02:00 UCOP/CISCO 1.544 mbps 00.2% 18:00 UCR/LLUMC 1.544 mbps 00.3% 21:00 CALTECH/CADAM 56 kbps 00.3% 20:00 CALTECH/CITY OF HOPE 56 kbps 00.3% 20:00 CALTECH/CLAREMONT 56 kbps 19.9% 13:00 CALTECH/DISNEY 56 kbps 05.3% 15:00 CALTECH/OXY 56 kbps 08.3% 17:00 SDSC/AJS 56 kbps 01.6% 12:00 SDSC/KOREA 56 kbps 05.1% 17:00 SDSC/QUALCOMM 56 kbps 06.3% 15:00 SDSC/SCIH 56 kbps 05.2% 13:00 SDSC/USD 56 kbps 05.3% 09:00 SDSC/USIU 56 kbps 00.4% 14:00 SDSC/XEROX 56 kbps 00.3% 20:00 UCI/CMD 56 kbps 01.7% 12:00 UCI/EMULEX 56 kbps 12.6% 15:00 UCI/FULLERTON 56 kbps 03.9% 11:00 UCI/HUGHES 56 kbps 01.0% 16:00 UCI/MTI 56 kbps 06.7% 12:00 UCI/SPARTA 56 kbps 03.1% 11:00 UCI/UNOCAL 56 kbps 01.2% 14:00 UCLA/ISX 56 kbps 00.9% 19:00 UCLA/PEPPERDINE 56 kbps 00.9% 18:00 UCLA/QUOTRON 56 kbps 09.8% 21:00 UCLA/SMC 56 kbps 02.2% 09:00 UCOP/FARALLON 56 kbps 04.1% 09:00 UCOP/INTEL 56 kbps 14.8% 14:00 UCOP/LSIL 56 kbps 07.4% 21:00 UCOP/NETLABS 56 kbps 13.9% 19:00 ------------------------------------------------------------------------------ SITE CISCO BOX UPTIME SINCE LAST REBOOT (as of 00:15 PST on May 25, 1992): CERFnet BACKBONE CALTECH [131.215.139.253] Up: 06 days 14 hours 02 minutes [Unknown - Please see ticket #990.] SDSC LongBoard [134.24.99.254] Up: 08 days 17 hours 46 minutes SDSC Drzog [132.249.16.13] Up: 11 days 14 hours 24 minutes SDSC Hang10 [132.249.16.15] Up: 11 days 14 hours 24 minutes UCI [128.200.1.101] Up: 25 days 16 hours 04 minutes UCLA [128.97.130.10] Up: 49 days 06 hours 28 minutes UCOP [134.24.52.112] Up: 61 days 16 hours 38 minutes UCR [134.24.108.105] Up: 64 days 06 hours 48 minutes CERF 1544 AGI [134.24.202.110] Up: 101 days 13 hours 54 minutes APPLE [134.24.70.200] Up: 210 days 06 hours 15 minutes BIOSYM [134.24.57.200] Up: 13 days 13 hours 52 minutes CISCO Systems [134.24.54.200] Up: 03 days 10 hours 16 minutes [Site Scheduled Maintenance - Please see ticket #1000.] CSUCO/SWRL [130.150.102.200] Up: 30 days 18 hours 08 minutes GA [134.24.221.200] Up: 01 days 14 hours 21 minutes [Power Outage] GD [134.24.60.200] Up: 24 days 16 hours 18 minutes LLUMC [134.24.208.200] Up: 187 days 12 hours 02 minutes MDC [134.24.65.200] Up: 96 days 09 hours 50 minutes SAIC [134.24.53.208] Up: 11 days 14 hours 10 minutes SCAQMD [134.24.234.200] Up: 157 days 14 hours 27 minutes SDSU [192.77.100.101] Up: 10 days 16 hours 29 minutes UCSB [134.24.107.107] Up: 187 days 07 hours 38 minutes CERF 56 AJS [134.24.225.101] Up: 128 days 14 hours 17 minutes CADAM [134.24.229.200] Up: 110 days 13 hours 01 minutes CICESE [134.24.227.200] Up: 05 days 09 hours 44 minutes [Power Outage - Please see ticket #998.] CITY_OF_HOPE [134.24.233.200] Up: 05 days 13 hours 48 minutes [Unknown] CLAREMONT [134.24.206.109] Up: 58 days 17 hours 39 minutes CMD [134.24.218.200] Up: 118 days 13 hours 14 minutes DATAPRODUCTS [134.24.211.104] Up: 54 days 09 hours 33 minutes DISNEY [134.24.207.211] Up: 44 days 10 hours 00 minutes EMULEX [134.24.209.212] Up: 43 days 12 hours 12 minutes FARALLON [134.24.56.200] Up: 19 days 04 hours 39 minutes FULLERTON [134.24.214.217] Up: 06 days 21 hours 03 minutes [Power Outage] GTE [134.24.212.200] Up: 70 days 16 hours 57 minutes HUGHES [134.24.204.200] Up: 33 days 10 hours 48 minutes INTEL [134.24.73.200] Up: 57 days 11 hours 34 minutes LSIL [134.24.72.200] Up: 19 days 08 hours 26 minutes MTI [134.24.216.100] Up: 29 days 09 hours 34 minutes NETLABS [134.24.71.200] Up: 60 days 08 hours 51 minutes OXY [134.24.205.108] Up: 48 days 16 hours 27 minutes PEPPERDINE [134.24.203.218] Up: 44 days 21 hours 42 minutes QUALCOMM [134.24.200.201] Up: 14 days 00 hours 52 minutes QUOTRON [134.24.230.202] Up: 09 days 06 hours 29 minutes SANTA MONICA [134.24.210.219] Up: 26 days 06 hours 29 minutes SCI-HOR [134.24.109.205] Up: 12 days 06 hours 02 minutes SEASPACE [134.24.80.200] Up: 46 days 11 hours 26 minutes SERI/KOREA [134.24.223.200] Up: 48 days 00 hours 40 minutes SPARTA [134.24.215.200] Up: 55 days 10 hours 57 minutes UNOCAL [134.24.217.200] Up: 80 days 01 hours 57 minutes USD [134.24.201.106] Up: 15 days 02 hours 56 minutes USIU [134.24.222.215] Up: 323 days 17 hours 07 minutes XEROX [134.24.51.207] Up: 207 days 23 hours 22 minutes DIAL n' CERF DNC-SDSC [134.24.1.2] Up: 11 days 14 hours 31 minutes DNC-UCI [134.24.2.2] Up: 25 days 15 hours 58 minutes DNC-UCLA [134.24.3.2] Up: 49 days 06 hours 25 minutes DNC-CALTECH [134.24.4.2] Up: 57 days 05 hours 42 minutes DNC-UCOP [134.24.5.2] Up: 11 days 14 hours 23 minutes SDSC-NETBLAZER [192.102.249.25] Up: 11 days 14 hours 28 minutes UCLA-NETBLAZER [134.24.93.2] Up: 02 days 12 hours 21 minutes [Unknown]

1 0

CERT Advisory - SunOS Environment Variables
by CERT Advisory 27 May '92

27 May '92

=========================================================================== CA-92:11 CERT Advisory May 27, 1992 SunOS Environment Variables and setuid/setgid Vulnerability --------------------------------------------------------------------------- The Computer Emergency Response Team/Coordination Center (CERT/CC) has received information concerning a vulnerability involving environment variables and setuid/setgid programs under Sun Microsystems Computer Corporation SunOS. This vulnerability exists on all Sun architectures running SunOS 4.0 and higher. In-house and third-party software can also be impacted by this vulnerability. For example, the current versions of rnews, sudo, smount, and npasswd are known to be vulnerable under SunOS. See the Description section of this advisory for details of how to identify software which may be vulnerable. The workaround detailed in this advisory can be used to protect vulnerable software on SunOS operating system versions for which patches are unavailable, or for local or third party software which may be vulnerable. Sun has provided patches for SunOS 4.1, 4.1.1, and 4.1.2 programs which are known to be impacted by this vulnerability. They are available through your local Sun Answer Center as well as through anonymous ftp from the ftp.uu.net (137.39.1.9) system in the /systems/sun/sun-dist directory. Fix PatchID Filename Checksum login and su 100630-01 100630-01.tar.Z 36269 39 sendmail 100377-04 100377-04.tar.Z 14692 311 Note: PatchID 100630-01 contains the international version of /usr/bin/login. PatchID 100631-01 contains the domestic version of /usr/bin/login and is only available from Sun Answer Centers for sites that use the US Encryption Kit. Please note that Sun will occasionally update patch files. If you find that the checksum is different please contact Sun or the CERT/CC for verification. --------------------------------------------------------------------------- I. Description A security vulnerability exists if a set-user-id program changes its real and effective user ids to be the same (but not to the invoker's id), and subsequently causes a dynamically-linked program to be exec'd. A similar vulnerability exists for set-group-id programs. In particular, SunOS /usr/lib/sendmail, /usr/bin/login, /usr/bin/su, and /usr/5bin/su are vulnerable to this problem. II. Impact Local users can gain unauthorized privileged access to the system. III. Solution A. Obtain and install the patches from Sun or from ftp.uu.net following the provided instructions. B. The following workaround can be used to protect vulnerable binaries for which patches are unavailable for your SunOS version, or for local or third party software which may be vulnerable. The example given is a workaround for /usr/lib/sendmail. 1. As root, rename the existing version of /usr/lib/sendmail and modify the permissions to prevent misuse. # mv /usr/lib/sendmail /usr/lib/sendmail.dist # chmod 755 /usr/lib/sendmail.dist 2. In an empty temporary directory, create a file wrapper.c containing the following C program source (remember to strip any leading white-space characters from the #define lines). /* Start of C program source */ /* Change the next line to reflect the full pathname of the file to be protected by the wrapper code */ #define COMMAND "/usr/lib/sendmail.dist" #define VAR_NAME "LD_" main(argc,argv,envp) int argc; char **argv; char **envp; { register char **cpp; register char **xpp; register char *cp; for (cpp = envp; cp = *cpp;) { if (strncmp(cp, VAR_NAME, strlen(VAR_NAME))==0) { for (xpp = cpp; xpp[0] = xpp[1]; xpp++); /* void */ ; } else { cpp++; } } execv(COMMAND, argv); perror(COMMAND); exit(1); } /* End of C program source */ 3. As root, compile the C program source for the wrapper and install the resulting binary. # make wrapper # mv ./wrapper /usr/lib/sendmail # chown root /usr/lib/sendmail # chmod 4711 /usr/lib/sendmail 4. Steps 1 through 3 should be repeated for other vulnerable programs with the appropriate substitution of pathnames and file names. The "COMMAND" C preprocessor variable within the C program source should also be changed to reflect the appropriate renamed system binary. --------------------------------------------------------------------------- The CERT/CC wishes to thank the following for their assistance: CIAC, PCERT, and in particular Wietse Venema of Eindhoven University, The Netherlands, for his support in the analysis of and a workaround for this problem. We also wish to thank Sun Microsystems Computer Corporation for their prompt response to this vulnerability. --------------------------------------------------------------------------- If you believe that your system has been compromised, contact CERT/CC or your representative in FIRST (Forum of Incident Response and Security Teams). Internet E-mail: cert(a)cert.org Telephone: 412-268-7090 (24-hour hotline) CERT/CC personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4), on call for emergencies during other hours. Computer Emergency Response Team/Coordination Center (CERT/CC) Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 Past advisories, information about FIRST representatives, and other information related to computer security are available for anonymous ftp from cert.org (192.88.209.5).

1 0

2451 copies of a CERT Advisory
by Edward DeHart 27 May '92

27 May '92

I would like to apologize to everyone who received more than one copy of the last CERT Advisory. The offending address that caused sendmail to crash and burn without updating the queue file has been removed. A Sun advisory will be sent out this morning. I hope that it will not be overlooked due to yesterday's mailer loop. Thank you, Ed DeHart Computer Emergency Response Team Internet E-mail: cert(a)cert.org Telephone: 412-268-7090 24-hour hotline: CERT/CC personnel answer 7:30a.m. to 6:00p.m. EST(GMT-5)/EDT(GMT-4), and are on call for emergencies during other hours.

1 0

NSF recompete mailing list.
by Gene.Hastings＠boole.ece.cmu.edu 26 May '92

26 May '92

Bob Aiken announced a mailing distribution list at the NSF for information (& discussions?) about the backbone recompetition. Send a request to recompete-request(a)cise.nsf.gov or recompete-request(a)nsf.gov. A copy of the announcement of the availabiltiy of the IINREN inplementation plan was sent to that list. I have not as yet seen anything else. Gene

1 0

CERT Advisory - AIX crontab Vulnerability
by CERT Advisory 26 May '92

26 May '92

=========================================================================== CA-92:10 CERT Advisory May 26, 1992 AIX crontab Vulnerability --------------------------------------------------------------------------- The Computer Emergency Response Team/Coordination Center (CERT/CC) has received information concerning a vulnerability in crontab(1) in version 3.2 of IBM's AIX operating system. IBM is aware of this problem and a fix is available as apar number "ix26997" for AIX version 3.2. The version information for the patched /usr/bin/crontab is shown in the following what(1) output: % what /usr/bin/crontab 04 1.23 com/cmd/cntl/cron/crontab.c, cmdcntl, bos320, 9218320f 4/8/92 11:50:42 07 1.8 com/cmd/cntl/cron/permit.c, bos, bos320 4/25/91 17:16:59 11 1.15 com/cmd/cntl/cron/cronsub.c, bos, bos320 8/18/91 20:42:32 06 1.9 com/cmd/cntl/cron/funcs.c, bos, bos320 6/8/91 21:22:40 If your crontab contains older modules than the above output indicates, we suggest that you install the fix. --------------------------------------------------------------------------- I. Description The distributed version of /usr/bin/crontab contains a security vulnerability. II. Impact Local users can gain unauthorized root access to the system. III. Solution The CERT/CC suggests that sites install the fix that IBM has made available. As an interim step, we suggests that sites prevent all non-root users from running /usr/bin/crontab by removing (or renaming) the /var/adm/cron/cron.allow and /var/adm/cron/cron.deny files. - Obtain the fix from IBM Support. 1. To order from IBM call 1-800-237-5511 and ask that the fix be shipped. Patches may be obtained outside the U.S. by contacting your local IBM representative. 2. If you are on the Internet, use anonymous ftp to obtain the fix from software.watson.ibm.com (129.34.139.5). Patch Filename Checksum AIX 3.2 pub/aix3/cronta.tar.Z 02324 154 The patch must be retrieved using binary mode. - Install the fix following the instructions in the README file. --------------------------------------------------------------------------- The CERT/CC would like to thank Fuat Baran of Advanced Network & Services, Inc. for bringing this security vulnerability to our attention and IBM for their quick response to this problem. --------------------------------------------------------------------------- If you believe that your system has been compromised, contact CERT/CC or your representative in FIRST (Forum of Incident Response and Security Teams). Internet E-mail: cert(a)cert.org Telephone: 412-268-7090 (24-hour hotline) CERT/CC personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4), on call for emergencies during other hours. Computer Emergency Response Team/Coordination Center (CERT/CC) Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 Past advisories, information about FIRST representatives, and other information related to computer security are available for anonymous ftp from cert.org (192.88.209.5).

1 0

Re: Additions, etc. to the NSFNET policy-based routing database
by Belinda Sue Blair 26 May '92

26 May '92

Regional techs and others, Greetings. Since nsfnet-admin received an incredibly low number of Network Announcement Change Requests over the Memorial Day weekend in this fine nation of ours, I am unilaterally, in the fine Haig tradition, postponing the configuration window one day to Tuesday night/Wednesday morning. NACRs will be accepted for this run until 2pm-ish Tuesday and the installation window will be from 05:00-08:00 Wednesday morning. If you need any configurations installed before then, please message trouble(a)merit.edu and state that you need an emergency config. The NOC can then page me and I will deal with it from there. Apologies for any inconvenience. Thanks, -B. Sue Blair Merit Network Operations

1 0