- NANOG - lists.nanog.org

CERT Advisory - AIX REXD Daemon Vulnerability
by CERT Advisory 05 Mar '92

05 Mar '92

=========================================================================== CA-92:05 CERT Advisory March 5, 1992 AIX REXD Daemon Vulnerability --------------------------------------------------------------------------- The Computer Emergency Response Team/Coordination Center (CERT/CC) has received information concerning a vulnerability with the rexd daemon in versions 3.1 and 3.2 of AIX for IBM RS/6000 machines. IBM is aware of the problem and it will be fixed in future updates to AIX 3.1 and 3.2. Sites may call IBM Support (800-237-5511) and ask for the patch for apar ix21353. Patches may be obtained outside the U.S. by contacting your local IBM representative. The fix is also provided below. --------------------------------------------------------------------------- I. Description In certain configurations, particularly if NFS is installed, the rexd (RPC remote program execution) daemon is enabled. Note: Installing NFS with the current versions of "mknfs" will re-enable rexd even if it was previously disabled. II. Impact If a system allows rexd connections, anyone on the Internet can gain access to the system as a user other than root. III. Solution CERT/CC and IBM recommend that sites take the following actions immediately. These steps should also be taken whenever "mknfs" is run. 1. Be sure the rexd line in /etc/inetd.conf is commented out by having a '#' at the beginning of the line: #rexd sunrpc_tcp tcp wait root /usr/etc/rpc.rexd rexd 100017 1 2. Refresh inetd by running the following command as root: refresh -s inetd --------------------------------------------------------------------------- The CERT/CC wishes to thank Darren Reed of the Australian National University for bringing this vulnerability to our attention and IBM for their response to the problem. --------------------------------------------------------------------------- If you believe that your system has been compromised, contact CERT/CC or your representative in FIRST (Forum of Incident Response and Security Teams). Internet E-mail: cert(a)cert.sei.cmu.edu Telephone: 412-268-7090 (24-hour hotline) CERT/CC personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4), on call for emergencies during other hours. Computer Emergency Response Team/Coordination Center (CERT/CC) Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 Past advisories, information about FIRST representatives, and other information related to computer security are available for anonymous ftp from cert.sei.cmu.edu (192.88.209.5).

1 0

I am leaving SURAnet
by oleary＠sura.net 04 Mar '92

04 Mar '92

March 20th will be my last day working at SURAnet. During April and May I will be traveling around the country, visiting schools and looking for a place to live, work, and take classes. Please direct any technical inquiries regarding SURAnet to "noc(a)sura.net" rather than to me directly as my access to electronic mail will be intermittent at best. Working with each of you has been quite enjoyable, and I certainly hope to keep in touch with all of you in the future. It is safe to assume that the next place I will be working is on the Internet.... :-) Thanks, dave o'leary SURAnet Network Operations Mgr.

1 0

Additions to the NSFNET policy-based routing database
by Steven K. Widmayer 03 Mar '92

03 Mar '92

The following networks have been added to the NSFNET policy-based routing database: T1 Network: Net # Net Name Primary Secondary Location -------- ----------- ------- --------- -------- 40 LILLY-NET 750 756 Eli Lilly and Company, Lilly Corporate Center, Mail Stop 2257, Indianapolis, IN 46285 138.12 MEADDATA 750 756 Mead Data Central, 9333 Springboro Pike, Miamisburg, OH 45342 141.173 CYANAMID 97 American Cyanamid, P.O.Box 817, Hannibal, MO 63401 143.131 DOWJONES 97 Dow Jones, Route 1 and Ridge Road, Princeton, NJ 08543 147.2 USL 97 UNIX Systems Laboratories, 190 River Road, Summit, NJ 07901 192.35.156 QUALNET2 1740 754 Qualcomm, Inc., 10555 Sorrento Valley Road, San Diego, CA 92121 192.70.74 FNET-ENSFCL 1238 Ecole Normale Superieure de Fontenay/Saint-Cloud, 31 rue Lombart, 92266 Fontenay-aux-Roses, FRANCE 192.109.57 SIEERL-LAN 701 1238 SIEMENS AG, ANL A434-SD, Guenther-Scharowski-Str . 2, D-W-8520 Erlangen, GERMANY 192.109.81 MAINZ-IBM-DE 701 1238 IBM Deutschland, Geb. 6500-67 / Kst. 7977, Hechtsheimer Str. 2, 6500 Mainz, GERMANY 192.122.251 MARKV-NET 1740 754 Mark V Systems Limited, 16400 Ventura Boulevard, Suite 303, Encino, CA 91436 192.132.89 NMHU-NET 771 372 New Mexico Highlands University, New Mexico Highlands University, Computer Center, Las Vegas, NM 87701 192.138.205 FALCON2 233 177 G-4195 W. Pasadena Ave., Genessee District Library, Michigan 192.148.93 PNL-ARM 291 293 Pacific Northwest Laboratory, Battelle Pacific Northwest Laboratory, P.O. Box 999 MSIN K1-88, Richland, WA 99352 192.149.1 ANSOFT 1206 204 Ansoft Corporation, 4 Station Square, Suite 660, Pittsburgh, PA 15219 192.149.13 NETALBRIGHT 1206 204 Albright College, Union and Linden Streets, Reading, PA 19604 Total NSFNET T1 announced networks: 4789 T3 Network: Network IP: 40 Network Name: LILLY-NET Location: Eli Lilly and Company, Lilly Corporate Center, Mail Stop 2257, Indianapolis, IN 46285 Country Code: US 1:17 ENSS 152 Purdue - AS Network IP: 138.12 Network Name: MEADDATA Location: Mead Data Central, 9333 Springboro Pike, Miamisburg, OH 45342 Country Code: US 1:1325 ANS Cleveland - DNSS 43 Network IP: 140.214 Network Name: MP-RECNET Location: U.S. Bureau of Reclamation, 2800 Cottage Way, Sacramento, CA, 95825 Country Code: US 1:201 BARRNet Network IP: 192.35.156 Network Name: QUALNET2 Location: Qualcomm, Inc., 10555 Sorrento Valley Road, San Diego, CA 92121 Country Code: US 1:1740 CERFnet Network IP: 192.122.251 Network Name: MARKV-NET Location: Mark V Systems Limited, 16400 Ventura Boulevard, Suite 303, Encino, CA 91436 Country Code: US 1:1740 CERFnet Network IP: 192.138.205 Network Name: FALCON2 Location: G-4195 W. Pasadena Ave., Genessee District Library, Michigan Country Code: US 1:237 MERIT network Network IP: 192.149.1 Network Name: ANSOFT Location: Ansoft Corporation, 4 Station Square, Suite 660, Pittsburgh, PA 15219 Country Code: US 1:1206 PSCNET Network IP: 192.149.13 Network Name: NETALBRIGHT Location: Albright College, Union and Linden Streets, Reading, PA 19604 Country Code: US 1:1206 PSCNET Total NSFNET T3 announced networks: 2398 T3 Special Additions: AS Number: 195 AS Notes: SDSC Regional network AS Country Code: US ANS: No Gate: 132.249.32.33 - rosebud.sdsc.edu ENSS 135 - San Diego AS Number: 685 AS Notes: AS 685 - ENSS 143 / University of Washington AS Country Code: US ANS: No Gate: 192.35.180.9 - seattle3-gw.nwnet.net ENSS 143 - University of Washington The configuration reports, map information sheets, and configuration files which reflect these changes are available for anonymous ftp on nis.nsf.net as usual. nsfsites - configuration reports latest report for: - NSFNET T1 has the file extension .now - NSFNET T3 has the file extension 3.now nsfconfg - configuration files for the routing software for each NSS latest report for: - NSFNET T1 has the file format config.nss# - NSFNET T3 has the file extension .t3p Please send all requests for configuration changes to nsfnet-admin(a)merit.edu using the NSFNET configuration forms. The forms are available on-line from the nis.nsf.net machine. Use ftp and the anonymous login to get on the machine. Do a "cd nsfsites" and grab the files TEMPLATE.NET, TEMPLATE.GATE, and TEMPLATE.AS. --Steve Widmayer Merit/NSFNET

1 0

February NSFNET T1 Usage by Service
by Susan.M.Horvath＠um.cc.umich.edu 02 Mar '92

02 Mar '92

NSFNET T1 Usage by Service February 1992 Service Type % Packets % Bytes ============ ========= ======= File exchange 27 50 Networked mail 20 22 Interactive 15 6 Name lookup 7 4 Other TCP/UDP services 29 17 Non TCP/UDP services 2 1 --- --- 100 100 The categories above are defined as follows: File exchange ftp: data and control (tcp ports 20, 21) Networked mail smtp, nntp, vmnet, uucp (tcp ports 25, 119, 175, 540) Interactive telnet, finger, who, login (tcp ports 23, 79, 513, udp port 513) Name lookup domain name service (udp port 53, tcp port 53) Other TCP/UDP services all tcp/udp ports not included above (e.g. irc, talk, X-windows, appletalk) Non-TCP/UDP services icmp, egp, etc. More detailed information is available for anonymous FTP from NIS.NSF.NET (the Merit/NSFNET Information Services machine) in the file NSF92-02.PORTS on the NSFSTATS directory.

1 0

CERFnet Weekly Report for the week of Monday 24, 1992.
by Donna Bigley 02 Mar '92

02 Mar '92

############################################################################### This is the CERFnet weekly activity report for the period of Monday, February 24th through Sunday, March 1st, 1992. This report is also available through anonymous FTP from NIC.CERF.NET [192.102.249.3] in the cerfnet/cerfnet_stats subdirectory. The filename is: 01-march-92.txt All times are in Pacific Standard Time, and in the 24-hour format. Please direct any questions or comments to: donnab(a)cerf.net or help(a)cerf.net ****************************************************************************** NETWORK OUTAGES: SITE: CERFnet SITES AFFECTED: Hang10 TIME STARTED: MON. 2-24-92 02:45 TIME ENDED: MON. 2-24-92 06:54 TIME ELAPSED: 4 hours 9 min. REASON: Equipment Trouble (Serial Board Died) SITE: CERFnet SITES AFFECTED: Hang10 TIME STARTED: MON. 2-24-92 17:00 TIME ENDED: MON. 2-24-92 17:01 TIME STARTED: MON. 2-24-92 17:08 TIME ENDED: MON. 2-24-92 17:11 TIME ELAPSED: 4 min. REASON: Equipment Trouble (Emergency Board Swap) SITE: HUGHES SITES AFFECTED: HUGHES TIME STARTED: TUE. 2-25-92 15:12 TIME ENDED: TUE. 2-25-92 20:54 TIME ELAPSED: 5 hours 42 min. REASON: Link Failure SITE: UCR SITES AFFECTED: UCR TIME STARTED: THU. 2-27-92 07:19 TIME ENDED: THU. 2-27-92 07:42 TIME ELAPSED: 23 min. REASON: Site Activity SITE: QUALCOMM SITES AFFECTED: QUALCOMM TIME STARTED: THU. 2-27-92 18:19 TIME ENDED: FRI. 2-28-92 04:45 TIME ELAPSED: 10 hours 26 min. REASON: Equipment Trouble SITE: DATAPRODUCTS SITES AFFECTED: DATAPRODUCTS TIME STARTED: FRI. 2-28-92 12:15 TIME ENDED: TIME ELAPSED: STILL FLAKING REASON: Unknown SITE: SANTA MONICA COLLEGE SITES AFFECTED: SANTA MONICA COLLEGE TIME STARTED: FRI. 2-28-92 12:16 TIME ENDED: FRI. 2-28-92 12:24 TIME ELAPSED: 8 min. REASON: Unknown SITE: CERFnet SITES AFFECTED: Longboard TIME STARTED: FRI. 2-28-92 17:39 TIME ENDED: FRI. 2-28-92 17:40 TIME ELAPSED: 1 min. REASON: Site Activity SITE: CERFnet SITES AFFECTED: ZOG, HANG10, and Longboard TIME STARTED: SAT. 2-29-92 17:16 TIME ENDED: SAT. 2-29-92 17:26 TIME ELAPSED: 10 min. REASON: Software Trouble (EGP Peering Trouble) SITE: GD SITES AFFECTED: GD TIME STARTED: SUN. 3-1-92 08:14 TIME ENDED: SUN. 3-1-92 10:42 TIME ELAPSED: 2 hours 28 min. REASON: Site Scheduled Maintenance ------------------------------------------------------------------------ CERFNET TRAFFIC CAPACITY USAGE AT EACH CIRCUIT LINK LINK SPEED CAPACITY PEAK HOUR (PDT) SDSC/CALTECH 1.544 mbps 09.3% 16:00 SDSC/UCI 1.544 mbps 06.2% 15:00 SDSC/UCLA 1.544 mbps 06.2% 15:00 SDSC/UCOP 1.544 mbps 03.5% 19:00 UCI/UCLA 1.544 mbps 00.5% 16:00 SDSC/UCR 512 kbps 02.5% 17:00 UCLA/UCSB 512 kbps 07.2% 09:00 SDSC/AGI 1.544 mbps 00.2% 20:00 SDSC/BIOSYM 1.544 mbps 00.2% 11:00 SDSC/GA 1.544 mbps 00.2% 18:00 SDSC/GD 1.544 mbps No Capacity available for this week. SDSC/SAIC 1.544 mbps 01.4% 15:00 SDSC/SCAQMD 1.544 mbps 00.02% 07:00 SDSC/SDSU 1.544 mbps 01.4% 10:00 UCI/CSU CO(SWRL) 1.544 mbps 02.4% 16:00 UCOP/APPLE 1.544 mbps 00.8% 13:00 UCOP/CISCO 1.544 mbps 00.2% 14:00 UCR/LLUMC 1.544 mbps 00.01% 16:00 CALTECH/CADAM 56 kbps 00.6% 13:00 CALTECH/CLAREMONT 56 kbps 23.6% 13:00 CALTECH/DISNEY 56 kbps 04.5% 15:00 CALTECH/OXY 56 kbps 06.3% 16:00 SDSC/AJS 56 kbps 01.6% 13:00 SDSC/KOREA 56 kbps 08.7% 18:00 SDSC/QUALCOMM 56 kbps 06.8% 15:00 SDSC/SCIH 56 kbps 04.5% 11:00 SDSC/USD 56 kbps 05.2% 11:00 SDSC/USIU 56 kbps 00.7% 15:00 SDSC/XEROX 56 kbps 03.8% 19:00 UCI/CMD 56 kbps 04.4% 20:00 UCI/EMULEX 56 kbps 01.9% 15:00 UCI/FULLERTON 56 kbps 01.8% 13:00 UCI/HUGHES 56 kbps 09.1% 13:00 UCI/MTI 56 kbps 03.4% 16:00 UCI/SPARTA 56 kbps 03.0% 13:00 UCI/UNOCAL 56 kbps 08.6% 20:00 UCLA/ISX 56 kbps 01.2% 16:00 UCLA/PEPPERDINE 56 kbps 02.2% 13:00 UCLA/QUOTRON 56 kbps 05.5% 13:00 UCLA/SMC 56 kbps 03.6% 01:00 UCOP/FARALLON 56 kbps 04.0% 14:00 UCOP/INTEL 56 kbps 15.6% 14:00 UCOP/LSIL 56 kbps 07.3% 20:00 UCOP/NETLABS 56 kbps 17.2% 19:00 ------------------------------------------------------------------------------ SITE CISCO BOX UPTIME SINCE LAST REBOOT (as of 00:15 PST on Mar. 2, 1992): CERFnet BACKBONE CALTECH [131.215.139.253] Up: 11 days 15 hours 51 minutes SDSC Drzog [132.249.16.13] Up: 01 days 05 hours 35 minutes [Site Activity] SDSC Hang10 [132.249.16.15] Up: 01 days 05 hours 16 minutes [Site Activity] UCI [128.200.1.101] Up: 52 days 16 hours 07 minutes UCLA [128.97.130.10] Up: 23 days 13 hours 42 minutes UCOP [134.24.52.112] Up: 06 days 17 hours 48 minutes [Equipment Trouble] UCR [134.24.108.105] Up: 107 days 12 hours 36 minutes CERF 1544 AGI [134.24.202.110] Up: 17 days 13 hours 54 minutes APPLE [134.24.70.200] Up: 126 days 06 hours 15 minutes BIOSYM [134.24.57.200] Up: 28 days 06 hours 48 minutes CISCO Systems [134.24.54.200] Up: 89 days 14 hours 09 minutes CSUCO/SWRL [130.150.102.200] Up: 05 days 04 hours 51 minutes [Software Trouble] GA [134.24.221.200] Up: 08 days 04 hours 41 minutes GD [134.24.60.200] Up: 00 days 13 hours 31 minutes [Site Scheduled Maintenance] LLUMC [134.24.208.200] Up: 103 days 12 hours 22 minutes SAIC [134.24.53.208] Up: 57 days 08 hours 34 minutes SCAQMD [134.24.234.200] Up: 73 days 14 hours 27 minutes SDSU [192.77.100.101] Up: 83 days 16 hours 31 minutes UCSB [134.24.107.107] Up: 103 days 07 hours 38 minutes CERF 56 AJS [134.24.225.101] Up: 44 days 14 hours 17 minutes CADAM [134.24.229.200] Up: 26 days 13 hours 01 minutes CLAREMONT [134.24.206.109] Up: 17 days 14 hours 02 minutes CMD [134.24.218.200] Up: 34 days 13 hours 14 minutes DATAPRODUCTS [134.24.211.104] Still Down [Site Activity] DISNEY [134.24.207.211] Up: 32 days 00 hours 33 minutes EMULEX [134.24.209.212] Up: 78 days 15 hours 48 minutes FARALLON [134.24.56.200] Up: 03 days 17 hours 19 minutes [Unknown] FULLERTON [134.24.214.217] Up: 76 days 15 hours 33 minutes HUGHES [134.24.204.200] Up: 108 days 07 hours 21 minutes INTEL [134.24.55.200] Up: 64 days 03 hours 19 minutes LSIL [134.24.72.200] Up: 22 days 13 hours 08 minutes MTI [134.24.216.100] Up: 58 days 13 hours 39 minutes NETLABS [134.24.71.200] Up: 86 days 15 hours 07 minutes OXY [134.24.205.108] Up: 17 days 19 hours 45 minutes PEPPERDINE [134.24.203.218] Up: 08 days 13 hours 14 minutes QUALCOMM [134.24.200.201] Up: 02 days 02 hours 36 minutes [Equipment Trouble] QUOTRON [134.24.230.202] Up: 98 days 13 hours 44 minutes SANTA MONICA [134.24.210.219] Up: 52 days 01 hours 22 minutes SCI-HOR [134.24.109.205] Up: 94 days 11 hours 15 minutes SERI/KOREA [134.24.223.200] Up: 160 days 00 hours 00 minutes SPARTA [134.24.215.200] Up: 17 days 19 hours 09 minutes UNOCAL [134.24.217.200] Up: 08 days 13 hours 01 minutes USD [134.24.201.106] Up: 32 days 15 hours 45 minutes USIU [134.24.222.215] Up: 239 days 17 hours 07 minutes XEROX [134.24.51.207] Up: 123 days 23 hours 22 minutes DIAL n' CERF DNC-SDSC [134.24.1.2] Up: 02 days 09 hours 04 minutes [Site Activity] DNC-UCI [134.24.2.2] Up: 54 days 03 hours 24 minutes DNC-UCLA [134.24.3.2] Up: 39 days 12 hours 38 minutes DNC-CALTECH [134.24.4.2] Up: 00 days 09 hours 17 minutes [Software Upgrade] DNC-UCOP [134.24.5.2] Up: 22 days 08 hours 58 minutes

1 0

Preview of ANSNET/NSFNET Backbone Engineering Report
by mak 28 Feb '92

28 Feb '92

We will include a more detailed report in the February Internet Monthly Report, but this summary gives a general report of events on the backbones over the last month. Mark ANSNET/NSFNET Backbone Engineering Report Preview of February, 1992 End-Of-Month Report ============================================= Mark Knopper, Merit Jordan Becker, ANS Summary ======= The T3 network continues to perform extremely well as it has since last November. During February, we have cut over a significant load of traffic from the T1 backbone to the T3 backbone. Midlevel networks that were cutover to use T3 in February include SURAnet (at both College Park and Atlanta), NyserNet/PSI, San Diego (SDSC and CERFNet), and SesquiNet. These are in addition to the other midlevel & regional networks that have previously been cut over to use the T3 system. We are coordinating with several other midlevel networks that we plan to cutover to T3 during the month of March. The midlevel networks continue to peer with both the T1 and T3 networks, and continue to use the T1 backbone to communicate with sites that have not yet cut over to the T3 backbone. This minimizes the load on the T1/T3 interconnect gateways in Ann Arbor, Houston, and San Diego. The interconnect gateway load has decreased as we have added load to the T3 system. We are also in the process of installing a 4th interconnect gateway at Princeton. T3 Network Status ================= Performance on the T3 network has been very good. There have been reports of intermittent packet loss, but this has been isolated to sources outside of the T3/T1 systems. As we migrate additional traffic onto the T3 network we are collecting daily reports on peak traffic load, and any packet discards on all CNSS/ENSS nodes in order to detect any problems caused by the added load. We are now measuring daily average sustained loads of about 5Mbps across a typical CNSS node (all interfaces) with an average packet size of about 200 bytes. The T3 backbone continues to be very reliable. There was a hardware problem on the backbone CNSS machine at Cleveland that resulted in two outages. We also continue to experience an occasional black link on CNSS-CNSS links. With the redundancy in the T3 network, none of these problems resulted in extended outages for any end users. There was also a routing software problem with the flooding of external BGP updates between the IBM and Cisco routers which we have worked around, and an SNMP monitoring problem which was identified and corrected. T1 Network Status Summary ========================= Performance and reliability on the T1 backbone has not been as good as T3 during February, but this is improving as we have (1) cut significant traffic over to the T3 system (2) are fixing several chronic problems that have been isolated and focused on during the last month. Some of these chronic problems and fixes include: - Congestion at NSS10 has been minimized by cutover of PSI/NyserNet traffic to the T3 system. We also replaced the PSP- 10-16 node to ensure that we were not having any intermittent hardware problems. - We recorded an above average number of T1 circuit outages reported during February. The increase in outages was largely due to two unrelated fiber cuts in the MCI network during the week of 2/17. - The "DCD Waffle" problem reported previously has been further diagnosed as two separate problems, and software corrections to these problems have already been partially deployed with the remaining software updates being tested on the research network for deployment during the coming week. A detailed description of these problems will be documented in the February Internet Monthly report. - An intermittent PSP crash problem is still being investigated. We suspect that this involves an RT kernel bug in the virtual memory system. - The fix to the "internally generated" ICMP net unreachable message problem has been successfully tested on the research network and will be deployed on the production network during the coming week. This should serve to minimize host problems resulting from any routing instabilities in the T1 network. - A new interior routing problem was identified where IS-IS link state PDUs were being truncated at sites where the regional was announcing over 2000 networks to the T1 backbone. A patch to the routing software to allow up to 2200 networks announced to a single NSS was already deployed as a near term fix. A new routing daemon that compresses the encoding of networks in the IS-IS link state packet is now being tested for deployment as a longer term solution.

1 0

Additions to the NSFNET policy-based routing database
by Belinda Sue Blair 28 Feb '92

28 Feb '92

The following networks have been added to the NSFNET policy-based routing database: T1 Network: Net # Net Name Primary Secondary Location -------- ----------- ------- --------- -------- 192.149.8 CCAC 1206 204 Community College of Allegheny County, 800 Allegheny Ave., Pittsburgh, PA 15233, USA 192.147.238 SUPERNET-DMZ 750 756 SuperNet/Supercomputing Review, 8445 Camino Santa Fe, Suite 204, San Diego, CA 92121, USA 192.147.230 ONE-NET 174 750 Open Networks Engineering, Inc., 777 East Eisenhower Parkway, Suite 315, Ann Arbor, MI 48108, USA 192.147.160 NWNET10 685 73 NorthWestNet, 15400 SE 30th Place, Suite 202, Bellevue, WA 98007, USA 192.147.44 MCIMAIL-DMZ 750 756 MCI Mail Operations, MCI Telecommunications, Inc., 501 63rd St., Downers Grove, IL 60516, USA 192.146.206 DROVERNET 93 Univ. of Science & Arts of OK, Box 82346 Chickasha OK 73018, USA 192.138.194 UHRICS 114 1700 University of Houston, College of Business, University of Houston, 4800, Calhoun, Houston, TX 77204-6282, USA 192.138.193 UHCBA 114 1700 University of Houston, College of Business, 4800, Calhoun, Houston, TX 77204-6282, USA 192.136.110 WESTNMUNIV 209 210 Western New Mexico University, P.O.Box 680, Silver City, NM 88062, USA 192.135.78 NCPC-NET 86 279 National Capital Planning Commission, NCPC, 801 Pennsylvannia Ave., NW, Suite 301, Wash., DC 20576, USA 192.103.12 USRA-NET 297 372 Universities Space Research Association, The Washington Office Center, 409 Third Street, SW, Suite 330, Washington, DC 20024, USA 192.77.173 PSINET-C-173 174 750 PSI, 165 Jordan Road, Troy, NY 12180, USA 192.70.171 MIAMI-MATH 194 University of Miami, Department of Mathematics and Computer Science, 1365 Memorial Drive, Room 515, Coral Gables, FL 33146, USA 192.70.57 FNET-CNET139 1238 FNET, Institut National de Recherche en Informatique et Automatique, Domaine de Voluceau, Rocquencourt, BP 105, F-78153 Le Chesnay CEDEX, FRANCE 192.31.89 MIAMI-CS-NET 194 University of Miami, Department of Mathematics and Computer Science, 1365 Memorial Drive, Room 515, Coral Gables, FL 33146, USA 157.199 HKR 174 750 Healthcare Knowledge Resources, Inc., 24 Frank Lloyd Wright Drive, P.O. Box 301, Ann Arbor, MI 48106-0301, USA 157.151 HOLONET 174 750 Information Access Technologies, Inc., HoloNet Internet Services, 46 Shattuck Square, Suite 11, Berkeley, CA 94704, USA 155.244 COCO-NET 174 750 Rome Research Corp., RL/C3DA, Griffiss AFB Building #3, Rome, NY 13441-5700, USA 152.106 RAUNET 701 702 Rand Afrikaans University, Johannesburg, REPUBLIC OF SOUTH AFRICA 151.160 MILLSAPS 279 86 Millsaps College, 1701 North State Street, Jackson, MS 39210, USA 150.148 DIMES 86 279 Parklawn Computer Center / DIMES HQ, Departmental Information Management Exchange system, Food & Drug Administration Room 2B57, 5600 Fishers Lane, Rockville, MD 20857, USA 138.65 FRANKFURT-GW1 184 164 Frankfurt Regional Information Center, V Corps Heasdquareters, Abrams Complex, Building 1, Frankfurt, GERMANY 137.19 ALLIED 555 Allied-Signal Corporation, P.O. Box 5016, 50 East Algonquin Road, Des Plaines, IL 60017-5016, USA 136.218 NUERNBERG-GW1 184 164 Nuernberg CDOIM, Building 1, W.O. Darby Kaserne, 8510 Fuerth, GERMANY 136.216 KARLSRUHE-GW1 184 164 CDOIM Karlsruhe, Smiley Barracks, Kanalweg 20, 7500 Karlsruhe, GERMANY 136.213 GRAFENWOEHR-GW1 184 164 CDOIM Grafenwoehr, Lager Gebaeude 8484, Camp Tunisia, 6144 Grafenwoehr, GERMANY 130.210 LINKNET 174 750 Link Flight Simulation Corporation, Industrial Park, Binghamton, NY 13902, USA 147.36 PIRMASENS-NET1 184 164 DCSOPS, 5th Signal Command, Pirmasens, GERMANY 144.215 TTI 1740 754 TTI/Citycorp, 3100 Ocean Park Blvd., Santa Monica, Ca. 90405, USA 143.53 BRAD-UNI 274 60 Bradford University, Computer Centre, Bradford, West Yorkshire BD7 1DP, UNITED KINGDOM 147.40 MANNHEIM-NET1 184 164 DCSOPS, 5th Signal Command, Mannheim, GERMANY 140.154 DARMSTADT-GW1 184 164 Darmstadt CDOIM, Building 4001, Cambrai Fritsch Kaserne, Darmstadt, GERMANY 139.222 UEA 274 60 University of East Anglia, University Plain, Norwich NR4 7TJ, UNITED KINGDOM 139.139 GIESSEN-GW1 184 164 Giessen, Pendleton Barracks, GERMANY 138.251 ST-AND 274 60 : LOCATION The University of St. Andrews, Fife, UNITED KINGDOM 146.182 UOVS 701 702 University of the Orange-Free State, Computer Centre, Bloemfontein 9300, REPUBLIC OF SOUTH AFRICA Total NSFNET T1 announced networks: 4775 T3 Network: Network IP: 130.210 Network Name: LINKNET Location: Link Flight Simulation Corporation, Industrial Park, Binghamton, NY 13902, USA Country Code: US 1:174 NYSERNET Regional Network / PSI Network IP: 131.214 Network Name: ROMENET Location: Rome Air Development Center/DCLD, Griffiss Air Force Base, Building 3, Rome, NY 13441-5700, USA Country Code: US 1:174 NYSERNET Regional Network / PSI Network IP: 144.215 Network Name: TTI Location: TTI/Citycorp, 3100 Ocean Park Blvd., Santa Monica, Ca. 90405, USA Country Code: US 1:1740 CERFnet Network IP: 146.182 Network Name: UOVS Location: University of the Orange-Free State, Computer Centre, Bloemfontein 9300, REPUBLIC OF SOUTH AFRICA Country Code: ZA 42:702 Alternet Router 43:701 Alternet Router Network IP: 150.148 Network Name: DIMES Location: Parklawn Computer Center / DIMES HQ, Departmental Information Management Exchange system, Food & Drug Administration Room 2B57, 5600 Fishers Lane, Rockville, MD 20857, USA Country Code: US 1:86 ENSS 136, College Park 2:279 Georgia Tech Network IP: 151.160 Network Name: MILLSAPS Location: Millsaps College, 1701 North State Street, Jackson, MS 39210, USA Country Code: US 1:279 Georgia Tech 2:86 ENSS 136, College Park Network IP: 152.106 Network Name: RAUNET Location: Rand Afrikaans University, Johannesburg, REPUBLIC OF SOUTH AFRICA Country Code: ZA 42:702 Alternet Router 43:701 Alternet Router Network IP: 155.244 Network Name: COCO-NET Location: Rome Air Development Center/DCLD, Griffiss Air Force Base, Building 3, Rome, NY 13441-5700, USA Country Code: US 1:174 NYSERNET Regional Network / PSI Network IP: 157.151 Network Name: HOLONET Location: Information Access Technologies, Inc., HoloNet Internet Services, 46 Shattuck Square, Suite 11, Berkeley, CA 94704, USA Country Code: US 1:174 NYSERNET Regional Network / PSI Network IP: 157.199 Network Name: HKR Location: Healthcare Knowledge Resources, Inc., 24 Frank Lloyd Wright Drive, P.O. Box 301, Ann Arbor, MI 48106-0301, USA Country Code: US 1:174 NYSERNET Regional Network / PSI Network IP: 192.73.216 Network Name: MDC Location: Mead Data Central, 933 Springboro Pike, Miamisburg, OH 45342, USA Country Code: US 1:1325 ANS Cleveland - DNSS 43 Network IP: 192.77.173 Network Name: PSINET-C-173 Location: PSI, 165 Jordan Road, Troy, NY 12180, USA Country Code: US 1:174 NYSERNET Regional Network / PSI Network IP: 192.132.29 Network Name: HUDSON Location: Hudson High School, 77 North Oviatt Street, Hudson, OH . Country Code: US 1:600 OARNET, Cleveland, OH Network IP: 192.135.78 Network Name: NCPC-NET Location: National Capital Planning Commission, NCPC, 801 Pennsylvannia Ave., NW, Suite 301, Wash., DC 20576, USA Country Code: US 1:86 ENSS 136, College Park 2:279 Georgia Tech Network IP: 192.138.193 Network Name: UHCBA Location: University of Houston, College of Business, 4800, Calhoun, Houston, TX 77204-6282, USA Country Code: US 1:114 SESQUINET Regional Network 2:1700 SESQUINET Regional Network Network IP: 192.138.194 Network Name: UHRICS Location: University of Houston, College of Business, University of Houston, 4800, Calhoun, Houston, TX 77204, USA Country Code: US 1:114 SESQUINET Regional Network 2:1700 SESQUINET Regional Network Network IP: 192.147.44 Network Name: MCIMAIL-DMZ Location: MCI Mail Operations, MCI Telecommunications, Inc., 501 63rd St., Downers Grove, IL 60516, USA Country Code: US 1:1323 ANS Chicago - DNSS 27 Network IP: 192.147.230 Network Name: ONE-NET Location: Open Networks Engineering, Inc., 777 East Eisenhower Parkway, Suite 315, Ann Arbor, MI 48108, USA Country Code: US 1:174 NYSERNET Regional Network / PSI Network IP: 192.147.238 Network Name: SUPERNET-DMZ Location: SuperNet/Supercomputing Review, 8445 Camino Santa Fe, Suite 204, San Diego, CA 92121, USA Country Code: US 1:1322 ANS Los Angeles - DNSS 19 Network IP: 192.149.8 Network Name: CCAC Location: Community College of Allegheny County, 800 Allegheny Ave., Pittsburgh, PA 15233, USA Country Code: US 1:1206 PSCNET Network IP: 192.147.44 Network Name: MCIMAIL-DMZ Location: MCI Mail Operations, MCI Telecommunications, Inc., 501 63rd St., Downers Grove, IL 60516, USA Country Code: US 1:1323 ANS Chicago - DNSS 27 Network IP: 192.147.230 Network Name: ONE-NET Location: Open Networks Engineering, Inc., 777 East Eisenhower Parkway, Suite 315, Ann Arbor, MI 48108, USA Country Code: US 1:174 NYSERNET Regional Network / PSI Network IP: 192.147.238 Network Name: SUPERNET-DMZ Location: SuperNet/Supercomputing Review, 8445 Camino Santa Fe, Suite 204, San Diego, CA 92121, USA Country Code: US 1:1322 ANS Los Angeles - DNSS 19 Network IP: 192.149.8 Network Name: CCAC Location: Community College of Allegheny County, 800 Allegheny Ave., Pittsburgh, PA 15233, USA Country Code: US 1:1206 PSCNET T3 special additions: ENSS 144 - NASA Ames ENSS 145 - College Park #2 Total NSFNET T3 announced networks: 2390 The configuration reports, map information sheets, and configuration files which reflect these changes are available for anonymous ftp on nis.nsf.net as usual. nsfsites - configuration reports latest report for: - NSFNET T1 has the file extension .now - NSFNET T3 has the file extension 3.now nsfconfg - configuration files for the routing software for each NSS latest report for: - NSFNET T1 has the file format config.nss# - NSFNET T3 has the file extension .t3p Please send all requests for configuration changes to nsfnet-admin(a)merit.edu using the NSFNET configuration forms. The forms are available on-line from the nis.nsf.net machine. Use ftp and the anonymous login to get on the machine. Do a "cd nsfsites" and grab the files TEMPLATE.NET, TEMPLATE.GATE, and TEMPLATE.AS. ************** -B. Sue Blair Merit Network Operations

1 0

Additions to the NSFNET policy-based routing database
by Steven K. Widmayer 26 Feb '92

26 Feb '92

The following networks have been added to the NSFNET policy-based routing database: T1 Network: Net # Net Name Primary Secondary Location -------- ----------- ------- --------- -------- 146.1 JAM-NET 114 1700 JAM, 3538 Bonilla, Houston, TX 77083 155.252 PWCPH 114 1700 Texas Women's College, Dallas, TX Total NSFNET T1 announced networks: 4740 T3 Network: 137 T1 configured Sesquinet (AS 114/280/1700) networks (not listed here) have been added to the T3 database. Network IP: 146.1 Network Name: JAM-NET Location: JAM, 3538 Bonilla, Houston, TX 77083 Country Code: US 1:114 SESQUINET Regional Network 2:1700 SESQUINET Regional Network Network IP: 155.252 Network Name: PWCPH Location: Texas Women's College, Dallas, TX Country Code: US 1:114 SESQUINET Regional Network 2:1700 SESQUINET Regional Network Network IP: 192.41.177 Network Name: SURA-NOC Location: University of Maryland, College Park, Maryland Country Code: US 42:702 Alternet Router 43:701 Alternet Router Total NSFNET T3 announced networks: 2369 The configuration reports, map information sheets, and configuration files which reflect these changes are available for anonymous ftp on nis.nsf.net as usual. nsfsites - configuration reports latest report for: - NSFNET T1 has the file extension .now - NSFNET T3 has the file extension 3.now nsfconfg - configuration files for the routing software for each NSS latest report for: - NSFNET T1 has the file format config.nss# - NSFNET T3 has the file extension .t3p Please send all requests for configuration changes to nsfnet-admin(a)merit.edu using the NSFNET configuration forms. The forms are available on-line from the nis.nsf.net machine. Use ftp and the anonymous login to get on the machine. Do a "cd nsfsites" and grab the files TEMPLATE.NET, TEMPLATE.GATE, and TEMPLATE.AS. --Steve Widmayer Merit/NSFNET

1 0

CERT Advisory - AT&T /usr/etc/rexecd Vulnerability
by CERT Advisory 25 Feb '92

25 Feb '92

=========================================================================== CA-92:04 CERT Advisory February 25, 1992 AT&T /usr/etc/rexecd Vulnerability --------------------------------------------------------------------------- The Computer Emergency Response Team/Coordination Center (CERT/CC) has received information concerning a vulnerability in AT&T TCP/IP Release 4.0 running on SVR4 systems for both the 386/486 and 3B2 RISC platforms. The existing error, in the remote execution server /usr/etc/rexecd, has been corrected, and a new executable for rexecd is available from AT&T by calling 800-543-9935. Patches may be obtained outside the U.S. by calling your local technical support. The numbers associated with the fix are 5127 (3.5" media) and 5128 (5.25" media). The problem does not exist in TCP/IP release 3.2 for SVR3, or any earlier versions of the TCP/IP product running on either the 3B2 or 386 platforms. The version of TCP/IP distributed with SVR4 by UNIX(r) System Laboratories, Inc. (a subsidiary of AT&T) does not contain this vulnerability. UNIX(r) is a registered trademark of UNIX System Laboratories, Inc. --------------------------------------------------------------------------- I. Description A vulnerability has been identified where root privileges may be accessed through the use of /usr/etc/rexecd. II. Impact A user on a remote machine may be able to run commands as root on the target host (the host running the affected /usr/etc/rexecd). III. Solution 1. Administrators of affected systems should execute, as root, the following command to immediately turn off access to rexecd until the new binary can be obtained. # chmod 400 /usr/etc/rexecd 2. Obtain and install the new patch. The fix will be supplied as one diskette, and it comes with one page of instructions documenting the procedure to replace the existing /usr/etc/rexecd binary. --------------------------------------------------------------------------- The CERT/CC wishes to thank Bradley E. Smith, Network & Technical Services, Bradley University, for bringing this vulnerability to our attention and for providing a corresponding solution. We would also like to thank AT&T for their very quick response to this problem. --------------------------------------------------------------------------- If you believe that your system has been compromised, contact CERT/CC or your representative in FIRST (Forum of Incident Response and Security Teams). Internet E-mail: cert(a)cert.sei.cmu.edu Telephone: 412-268-7090 (24-hour hotline) CERT/CC personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4), on call for emergencies during other hours. Computer Emergency Response Team/Coordination Center (CERT/CC) Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 Past advisories, information about FIRST representatives, and other information related to computer security are available for anonymous ftp from cert.sei.cmu.edu (192.88.209.5).

1 0

Additions to the NSFNET policy-based routing database
by Steven K. Widmayer 25 Feb '92

25 Feb '92

The following networks have been added to the NSFNET policy-based routing database: T1 Network: Net # Net Name Primary Secondary Location -------- ----------- ------- --------- -------- 145.30 AMSMSS 590 Koninklijke/Shell-Labor otorium Amsterdam, P.O.Box 3003; NL - 1003 AA Amsterdam, NETHERLANDS 152.79 UCDMC 201 754 University of California, Davis, Computing Services, Davis, CA 95626 156.116 NR-NCC 1238 Norwegian Computer Center, P.O. Box 114, Blindern, N-0314 Oslo, NORWAY 192.36.73 TIPNET 1238 Swedish Telecom, S-123 86 Farsta, SWEDEN 192.88.195 OARNET-BLOCK4 750 756 Ohio Supercomputer Center, 1224 Kinnear Road, Columbus, OH 43212 192.92.130 EUNET-BE 701 1238 EUnet Belgium, c/o KU Leuven, Dept. Computerwetenschappen, Celestijnenlaan 200A, B-3001 Heverlee, BELGIUM 192.92.131 EUNET-BE-LINKS 701 1238 EUnet Belgium, c/o KU Leuven, Dept. Computerwetenschappen, Celestijnenlaan 200A, B-3001 Heverlee, BELGIUM Total NSFNET T1 announced networks: 4733 T3 Network: 56 T1 configured CICnet (AS 266/267) networks (not listed here) have been added/changed in the T3 database to OARNet (AS 600). Network IP: 152.79 Network Name: UCDMC Location: University of California, Davis, Computing Services, Davis, CA 95626 Country Code: US 1:201 BARRNet Network IP: 192.88.195 Network Name: OARNET-BLOCK4 Location: Ohio Supercomputer Center, 1224 Kinnear Road, Columbus, OH 43212 Country Code: US 1:600 OARNET, Cleveland, OH Total NSFNET T3 announced networks: 2217 The configuration reports, map information sheets, and configuration files which reflect these changes are available for anonymous ftp on nis.nsf.net as usual. nsfsites - configuration reports latest report for: - NSFNET T1 has the file extension .now - NSFNET T3 has the file extension 3.now nsfconfg - configuration files for the routing software for each NSS latest report for: - NSFNET T1 has the file format config.nss# - NSFNET T3 has the file extension .t3p Please send all requests for configuration changes to nsfnet-admin(a)merit.edu using the NSFNET configuration forms. The forms are available on-line from the nis.nsf.net machine. Use ftp and the anonymous login to get on the machine. Do a "cd nsfsites" and grab the files TEMPLATE.NET, TEMPLATE.GATE, and TEMPLATE.AS. --Steve Widmayer Merit/NSFNET

1 0