-----BEGIN PGP SIGNED MESSAGE----- - --ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT-- - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE--- ======= ============ ====== ====== ======= ============== ======= ======= === === ==== ====== ====== === =========== ======= ======= === =========== === ======= === === === ==== === ===== === ======= ============== ===== === ===== ======= ============ ===== = ===== EMERGENCY RESPONSE SERVICE SECURITY VULNERABILITY ALERT 16 April 1996 16:00 GMT Number: ERS-SVA-E01-1996:003.1 =============================================================================== VULNERABILITY SUMMARY VULNERABILITY: Vulnerability in the IBM AIX "rmail" program. PLATFORMS: AIX Version 3 (Version 4 does not contain this vulnerability). SOLUTION: Take one of the actions described below. THREAT: A user can gain unauthorized access to another user's mail. =============================================================================== DETAILED INFORMATION I. Description There is a potential security exposure in the "rmail" program on Version 3 of the IBM AIX operating system. Version 4 of AIX does not contain this vulnerability. II. Impact A user with knowledge of this vulnerability can exercise it to obtain unauthorized access to another user's electronic mail. III. Solutions The IBM AIX Response Team recommends two solutions to this problem: 1. Log in to the workstation as "root" and issue the command: # /usr/bin/chmod 555 /usr/bin/rmail /bin/rmail 2. Apply the following APAR to your system once the APAR is available: APAR - IX57680 The first solution should be applied immediately to remove the vulnerability to your system. Once the APAR is available, you should also apply the second solution. IV. Acknowledgements IBM-ERS would like to thank the IBM AIX Response Team for providing the information contained in this alert. =============================================================================== IBM's Internet Emergency Response Service (IBM-ERS) is a subscription-based Internet security response service that includes computer security incident response and management, regular electronic verification of your Internet gateway(s), and security vulnerability alerts similar to this one that are tailored to your specific computing environment. By acting as an extension of your own internal security staff, IBM-ERS's team of Internet security experts helps you quickly detect and respond to attacks and exposures across your Internet connection(s). As a part of IBM's Business Recovery Services organization, the IBM Internet Emergency Response Service is a component of IBM's SecureWay(tm) line of security products and services. From hardware to software to consulting, SecureWay solutions can give you the assurance and expertise you need to protect your valuable business resources. To find out more about the IBM Internet Emergency Response Service, send an electronic mail message to ers-sales@vnet.ibm.com, or call 1-800-742-2493 (Prompt 4). IBM-ERS is a Member Team of the Forum of Incident Response and Security Teams (FIRST), a global organization established to foster cooperation and response coordination among computer security teams worldwide. Copyright 1996 International Business Machines Corporation. The information in this document is provided as a service to customers of the IBM Emergency Response Service. Neither International Business Machines Corporation, Integrated Systems Solutions Corporation, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process contained herein, or represents that its use would not infringe any privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by IBM or its subsidiaries. The views and opinions of authors expressed herein do not necessarily state or reflect those of IBM or its subsidiaries, and may not be used for advertising or product endorsement purposes. The material in this security alert may be reproduced and distributed, without permission, in whole or in part, by other security incident response teams (both commercial and non-commercial), provided the above copyright is kept intact and due credit is given to IBM-ERS. This security alert may be reproduced and distributed, without permission, in its entirety only, by any person provided such reproduction and/or distribution is performed for non-commercial purposes and with the intent of increasing the awareness of the Internet community. - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE--- - --ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT-- -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBMbbrTPWDLGpfj4rlAQE2TQP/csNoFGtv82ptFuzcRnYwUPJgRcwTsuxk CeUvwAA/p17OFE52KyF6tWa+bklaSvxx8uAnw1NunGS8FHgoKZpSq5LPL7s6kbeY aqpWIl3cNU6OZD/K4seoUJy38HvPMtRAS/6bxShyQ1aL0OwkFSGtC1lEv9qlFjka m9cNHAq/sMU= =j9hh -----END PGP SIGNATURE-----