PASS TO SITE/FACILITY/COMMAND INFORMATION SYSTEM SECURITY OFFICER {ISSO}, SPECIAL SECURITY OFFICER {SSO}, INFORMATION RESOURCE MANAGER {IRM} AND AUTOMATED DATA PROCESSOR {ADP} COORDINATORS SUBJECT: VARIOUS SECURITY VULNERABILITIES IN SUNOS 4.1.3, 4.1.2, 4.1.1, 4.1, 4.0.3 AND 5.0 (SOLARIS 2.0).{AUTOMATED SYSTEM SECURITY INCIDENT SUPPORT TEAM {ASSIST} BULLETIN 92-67}. 1. ASSIST HAS RECEIVED INFORMATION FROM SUN MICROSYSTEMS REGARDING THE AVAILABILITY OF THE FOLLOWING EIGHTEEN SECURITY PATCHES FOR SUNOS VERSIONS 4.1.3, 4.1.2, 4.1.1, 4.1, 4.0.3 AND SOLARIS 2.0 (WHICH CONTAINS SUNOS 5.0). THE PATCHES ARE AVAILABLE BOTH THROUGH YOUR LOCAL SUN ANSWER CENTER AND ANONYMOUS FTP. IN THE U.S., FTP TO FTP.UU.NET AND RETRIEVE THE PATCHES FROM THE /SYSTEMS/SUN/SUN-DIST DIRECTORY. IN EUROPE, FTP TO MCSUN.EU.NET AND RETRIEVE THE PATCHES FROM THE ~FTP/SUN/FIXES DIRECTORY. THE PATCHES ARE CONTAINED IN COMPRESSED TAR FILES NAMED [PATCH].TAR.Z. FOR EXAMPLE, IF YOU WISH TO OBTAIN PATCH 100103-11, THE TARFILE WOULD BE 100103-11.TAR.Z. EACH PATCH HAS BEEN CHECKSUMMED USING THE SUNOS "SUM" COMMAND SO ITS VALIDITY CAN BE VERIFIED BY THE END USER. SOME OF THE PATCHES MAY BE UPDATED AFTER THIS BULLETIN IS RELEASED AND THE CHECKSUM OF THE PATCH YOU RECEIVE MAY NOT MATCH THE CORRESPONDING CHECKSUM LISTED IN THIS MESSAGE. CHECK THE README FILE INCLUDED WITH EACH PATCH FOR THE CURRENT CHECKSUM OR CALL SUN MICROSYSTEMS IF THERE IS A DISCREPANCY. TO INSTALL THE PATCHES ON YOUR SYSTEM, FOLLOW THE INSTRUCTIONS CONTAINED IN THE README FILES WHICH ACCOMPANY EACH PATCH. 2. THE FOLLOWING TEN PATCHES (EXCEPT FOR THE LAST, NEW PATCH) ARE NEW REVISIONS, SUPERSEDING OLDER PATCH VERSIONS, AND THEY ALL INCLUDE FIXES FOR NEW BUGS. ALL DESIGNATED VERSIONS OF SUNOS SHOULD BE UPGRADED WITH THESE PATCHES. A BRIEF DESCRIPTION OF EACH PATCH IS PROVIDED. PATCH CHECKSUM SUNOS VERSIONS ----- -------- --------------------------------------------- - 100103-11 19847 6 4.1.3, 4.1.2, 4.1.1, 4.1 A SHELL SCRIPT MODIFIES FILE PERMISSIONS TO A MORE SECURE MODE. THE SCRIPT CHANGES THE PERMISSIONS FOR TWO ADDITIONAL FILES: /VAR/YP/`DOMAINNAME`/MAIL.ALIASES.DIR AND /VAR/YP/`DOMAINNAME`/MAIL.ALIASES.PAG 100173-09 28314 788 4.1.3, 4.1.2, 4.1.1, 4.1 NFS JUMBO PATCH - REPAIRS A PROBLEM WHEN ACCESSING NFS MOUNTED FILES AS ROOT. THIS PATCH REQUIRES THAT A NEW KERNEL BE CONFIGURED, MADE AND INSTALLED. THE INSTALLER NEEDS TO BUILD A NEW KERNEL ONLY ONCE EVEN IF MULTIPLE PATCHES ARE INSTALLED, AS LONG AS ALL THE OBJECT FILES (".O" FILES) FROM ALL PATCHES ARE LOADED. 100267-09 55338 5891 4.1.1 THIS IS THE INTERNATIONAL VERSION OF THE LIBC REPLACEMENT WITH ALL 4.1.1 PATCHES. NEW BUG FIXES INCLUDE: INNETGR MAY ACKNOWLEDGE FALSE NETGROUP MEMBERSHIP, UNDEFINED SYMBOLS WHEN LINKING STATICALLY WITH "MBLEN()", MBTOWC AND MBSTOWCS GIVE DIFFERENT RESULTS FOR SAME CHARACTER. 100305-10 28781 368 4.1.3, 4.1.2, 4.1.1, 4.1 FIX FOR LPR, LPD, LPSTAT -V, PASSWD, DELETE, AND SYSTEM. THIS PATCH ALSO CONTAINS A NEW BUG FIX FOR LPSTAT -V. 100377-05 29141 1076 4.1.3, 4.1.2, 4.1.1, 4.1 SENDMAIL JUMBO PATCH - FIXES SENDMAIL, SENDMAIL.MX REMEDIES FIVE NEW BUGS IN SENDMAIL. 100507-04 57590 61 4.1.3, 4.1.2, 4.1.1 TMPFS JUMBO PATCH - COPYING FILES FROM AN NFS MOUNTED PARTITION TO A TMPFS MOUNT CAN RESULT IN A SECURITY BREACH. THIS PATCH REQUIRES THAT A NEW KERNEL BE CONFIGURED, MADE AND INSTALLED. THE INSTALLER NEEDS TO BUILD A NEW KERNEL ONLY ONCE EVEN IF MULTIPLE PATCHES ARE INSTALLED, AS LONG AS ALL THE OBJECT FILES (".O" FILES) FROM ALL PATCHES ARE LOADED. 100513-01 20616 480 4.1.3, 4.1.2, 4.1.1, 4.1 JUMBO TTY PATCH - CONSOLIDATES MANY PATCHES, INCLUDING SECURITY PATCH 100188-02 (TIOCCONS REDIRECTION OF CONSOLE OUTPUT/INPUT). THIS PATCH REQUIRES THAT A NEW KERNEL BE CONFIGURED, MADE AND INSTALLED. THE INSTALLER NEEDS TO BUILD A NEW KERNEL ONLY ONCE EVEN IF MULTIPLE PATCHES ARE INSTALLED, AS LONG AS ALL THE OBJECT FILES (".O" FILES) FROM ALL PATCHES ARE LOADED. 100201-06 13145 164 4.1.1, 4.1 C2 JUMBO PATCH - FIXES DELAY WITH YPPASSWD WHEN RUNNING C2 WITH NIS, UNPRIVILEGED ACCESS TO ENVIRONMENT VARIABLES, AND A PROBLEM WHERE AN IMAGE CONTAINS PLAINTEXT PASSWORDS AND PASSWD.ADJUNCT FILE. 100564-04 00115 824 4.1.3, 4.1.2 C2 JUMBO PATCH - FIXES PROBLEM WHERE AN IMAGE CONTAINS PLAINTEXT PASSWORDS AND PASSWD.ADJU/NCT FILE. 100723-01 22726 1 SOLARIS 2.0/SUNOS 5.0 (NEW PATCH) THE SOLARIS 2.0FCS INSTALL LEAVES WORLD-WRITABLE DIRECTORIES. NOTE: THIS PATCH CONTAINS A README FILE ONLY. THE README INSTRUCTS THE INSTALLER TO RUN THE FOLLOWING COMMAND AS ROOT AFTER THE INSTALLATION OF SOLARIS 2.0/SUNOS 5.0: #PKGCHK -F CORRECTING THE DIRECTORY AND FILE ATTRIBUTES INCORRECTLY SET DURING THE INSTALLATION PROCESS. THE FOLLOWING PATCH IS THE UPGRADE FOR COMPATIBILITY WITH SUNOS VERSIONS 4.1.2 AND 4.1.3. IF YOU HAVE A PRE-4.1.2 SYSTEM AND HAVE PREVIOUSLY LOADED THIS PATCH, YOU NEED NOT APPLY THIS TO YOUR SYSTEM. 100372-02 22739 712 4.1.3, 4.1.2, 4.1.1 TFS AND C2 DO NOT WORK TOGETHER THIS PATCH IS PROVIDED FOR C2 SECURITY, AND IS ONLY NECESSARY IF YOU USE C2 WITH TFS (TRANSLUCENT FILE SERVICE). THE FOLLOWING SEVEN PATCHES ARE UPGRADED TO BE COMPATIBLE WITH SUNOS 4.1.3. IF YOU HAVE A PRE-4.1.3 SYSTEM AND HAVE PREVIOUSLY LOADED THESE PATCHES, YOU NEED NOT APPLY THESE TO YOUR SYSTEM. 100296-04 42492 40 4.1.3, 4.1.2, 4.1.1 NETGROUP EXPORTS TO WORLD. 100482-03 27837 342 4.1.3, 4.1.2, 4.1.1, 4.1 YPSERV, YPXFRD. NOTE: THE /VAR/YP/SECURENETS CONFIGURATION FILE PROVIDED WITH THIS PATCH DOES NOT SUPPORT BLANK LINES. 100383-05 52230 135 4.1.3, 4.1.2, 4.1.1, 4.1, 4.0.3 RDIST SECURITY ENHANCEMENT. 100567-04 15728 11 4.1.3, 4.1.2, 4.1.1, 4.1 ICMP REDIRECTS, MFREE PANIC. THIS PATCH REQUIRES THAT A NEW KERNEL BE CONFIGURED, MADE AND INSTALLED. THE INSTALLER NEEDS TO BUILD A NEW KERNEL ONLY ONCE EVEN IF MULTIPLE PATCHES ARE INSTALLED, AS LONG AS ALL THE OBJECT FILES (".O" FILES) FROM ALL PATCHES ARE LOADED. 100630-01 28074 39 4.1.3, 4.1.2, 4.1.1, 4.1 100631-01 44444 25 4.1.3, 4.1.2, 4.1.1, 4.1 PATCH FOR LOGIN, SU, LD_ ENVIRONMENT VARIABLES. 100630-01 IS THE INTERNATIONAL VERSION OF /BIN/LOGIN FOR SYSTEMS NOT USING THE US ENCRYPTION KIT. /USR/BIN/SU AND /USR/5BIN/SU FROM THE INTERNATIONAL VERSION ARE SUITABLE FOR SITES THAT USE THE US ENCRYPTION KIT. 100631-01 IS THE DOMESTIC VERSION. TO OBTAIN 100631-01, CONTACT YOUR LOCAL SUN ANSWER CENTER. 100633-01 33264 20 4.1.3, 4.1.2, 4.1.1 DESCR: UNBUNDLED SUNSHIELD ARM 1.0, "LD_" ENVIRONMENT VARIABLES CAN BE USED TO EXPLOIT LOGIN/SU, INTERNATIONAL VERSION. 3. POINT OF CONTACT: ASSIST POINT OF CONTACT FOR THIS MATTER IS MIKE HIGGINS, COMM {703} 696-1904 OR DSN 226-1904. ASSIST CAN BE REACHED 24 HOURS PER DAY, COMMERCIAL PAGER {800} SKY-PAGE {800-759- 7243}, PIN NUMBER 2133937. WHEN CALLING THE PAGER SERVICE, FOLLOW THE AUTOMATED VOICE INSTRUCTIONS AND ENTER THE CALL BACK NUMBER AFTER THE PROMPT. THE ASSIST DUTY OFFICER WILL CALL YOU BACK WITHIN 30 MINUTES. IF FASTER SERVICE IS REQUIRED, PREFIX YOUR TELEPHONE NUMBER WITH "999", AND THE ASSIST DUTY OFFICER WILL CALL BACK WITHIN 5 MINUTES. ASSIST CAN BE REACHED VIA E-MAIL AT "DOD- CERT{AT-SIGN}DDN-CONUS.DDN.MIL". BT