CERT Vendor-Initiated Bulletin VB-94:02 December 14, 1994 Topic: Security Advisory #0505 ULTRIX and DEC OSF/1 Source: Digital Equipment Corporation, Software Security Response Team Related CERT documents: CERT Advisory CA-94:12 "Sendmail Vulnerabilities" To aid in the wide distribution of essential security information, the CERT Coordination Center is forwarding the following information from Digital Equipment Corp. Digital urges you to act on this information as soon as possible. Digital contact information is included in the forwarded text below; please contact them if you have any questions or need further information. ===========================FORWARDED TEXT STARTS HERE========================= SOURCE: Digital Equipment Corporation - ( DSIN / DSNlink FLASH MAIL ) Software Security Response Team 17.MAY.94 PRODUCT: ULTRIX Versions 4.3, 4.3A, V4.4 DECnet-ULTRIX Version 4.2 DEC OSF/1 Versions 1.2, 1.3, 1.3A, 2.0 ADVISORY INFORMATION: SUBJECT: Security Enhanced Kit for DECNET-ULTRIX V4.2, ULTRIX V4.3 (VAX/RISC), ULTRIX V4.3A (RISC), ULTRIX V4.4 (VAX/RISC), ULTRIX Worksystem Software and DEC OSF/1 V1.2 - V2.0 IMPACT: Potential security vulnerabilities exist where, under certain circumstances user access or privilege may be expanded. SOLUTION: ULTRIX: Upgrade/Install ULTRIX to an minimum of V4.4 and install the Security Enhanced Kit DEC OSF/1: Upgrade/Install to a minimum of V1.2 and install the Security Enhanced Kit [Note: In the text below, Digital identifies OSF/1 V2.0 as the minimum. Digital has confirmed that 2.0 is correct. --CERT staff] _______________________________________________________________________________ These kits are available from Digital Equipment Corporation by contacting your normal Digital support channel or by request via DSNlink for electronic transfer. _______________________________________________________________________________ IMPACT: Digital has discovered the existence of potential security vulnerabilities in the ULTRIX V4.3, V4.3a, V4.4 and DEC OSF/1 V1.2, V1.3, V2.0 Operating Systems, and DECnet-ULTRIX V4.2. These potential vulnerabilities were discovered as a result of evaluating recent reports of potential security vulnerabilities which were distributed on the INTERNET and as a result of Digital's continued engineering efforts. The solutions to these vulnerabilities have been included in the next release of ULTRIX and DEC OSF/1. The kits have been created to correct potential security vulnerabilities which, under certain circumstances may expand user access or privilege. Digital Equipment Corporation strongly urges Customers to upgrade to a minimum of ULTRIX V4.4 and DEC OSF/1 V2.0 then apply the Security Enhanced Kit. - Please refer to the applicable Release Note information prior to upgrading your installation. _______________________________________________________________________________ KIT PART NUMBERS and DESCRIPTIONS CSC PATCH # CSCPAT_4060 V1.0 ULTRIX V4.3 thru V4.4 (Includes DECnet-ULTRIX V4.2) CSCPAT_4061 V1.0 DEC OSF/1 V1.2 thru V2.0 _______________________________________________________________ These kits will not install on versions previous to ULTRIX V4.3 or DEC OSF/1 V1.2. _______________________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________ The ULTRIX Security Enhanced kit replaces the following images: /usr/etc/comsat ULTRIX V4.3, V4.3a, V4.4 /usr/ucb/lpr " " /usr/bin/mail " " /usr/lib/sendmail " " /usr/etc/telnetd ULTRIX V4.3, V4.3a only ______________________________________ for DECnet-ULTRIX V4.2 installations: /usr/etc/dlogind /usr/etc/telnetd.gw *sendmail - is a previously distributed solution. _______________________________________________________________________________ The DEC OSF/1 Security Enhanced kit replaces the following images: /usr/sbin/comsat DEC OSF/1 V1.2, V1.3 V2.0 /usr/bin/binmail /usr/bin/lpr " " /usr/sbin/sendmail DEC OSF/1 V1.2, V1.3 only /usr/bin/rdist " " /usr/shlib/libsecurity.so DEC OSF/1 V2.0 only *sendmail - is a previously distributed solution. _______________________________________________________________________________ Digital urges you to periodically review your system management and security procedures. Digital will continue to review and enhance the security features of its products and work with customers to maintain and improve the security and integrity of their systems. _______________________________________________________________________________ NOTE: For non-contract/non-warranty customers contact your local Digital support channels for information regarding these kits. ______________________________________________________________________________ ======================FORWARDED TEXT ENDS HERE=============================== CERT bulletins, CERT advisories, information about FIRST representatives, and other information related to computer security are available for anonymous FTP from info.cert.org. If you wish to send sensitive incident or vulnerability information to CERT staff by electronic mail, we strongly advise that the e-mail be encrypted. The CERT Coordination Center can support a shared DES key, PGP (public key available via anonymous FTP on info.cert.org), or PEM (contact CERT staff for details). Internet E-mail: cert@cert.org Telephone: +1 412-268-7090 (24-hour hotline) CERT personnel answer 8:30 a.m.-5:00 p.m. EST(GMT-5)/EDT(GMT-4), and are on call for emergencies during other hours. Fax: +1 412-268-6989 CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 USA CERT is a service mark of Carnegie Mellon University.