92 lines
4.2 KiB
Plaintext
92 lines
4.2 KiB
Plaintext
|
***********************************************************************
|
|||
|
|
DDN Security Bulletin 05 DCA DDN Defense Communications System
|
|||
|
|
23 Oct 89 Published by: DDN Security Coordination Center
|
|||
|
|
(SCC@NIC.DDN.MIL) (800) 235-3155
|
|||
|
|
|
|||
|
|
DEFENSE DATA NETWORK
|
|||
|
|
SECURITY BULLETIN
|
|||
|
|
|
|||
|
|
The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security
|
|||
|
|
Coordination Center) under DCA contract as a means of communicating
|
|||
|
|
information on network and host security exposures, fixes, & concerns
|
|||
|
|
to security & management personnel at DDN facilities. Back issues may
|
|||
|
|
be obtained via FTP (or Kermit) from NIC.DDN.MIL [26.0.0.73 or
|
|||
|
|
10.0.0.51] using login="anonymous" and password="guest". The bulletin
|
|||
|
|
pathname is SCC:DDN-SECURITY-nn (where "nn" is the bulletin number).
|
|||
|
|
|
|||
|
|
**********************************************************************
|
|||
|
|
|
|||
|
|
ULTRIX 3.0 BREAK-IN ATTEMPTS
|
|||
|
|
|
|||
|
|
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
|
|||
|
|
! Although there are only thirteen MILNET sites running any version of !
|
|||
|
|
! Ultrix, the SCC is forwarding this CERT Advisory as an aid to those !
|
|||
|
|
! Internet sites which may be affected. Note that these problems !
|
|||
|
|
! have affected only sites running Ultrix 3.0. !
|
|||
|
|
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
|
|||
|
|
|
|||
|
|
CERT Advisory
|
|||
|
|
DEC/Ultrix 3.0 Systems
|
|||
|
|
|
|||
|
|
Recently, the CERT/CC has been working with several Unix sites that
|
|||
|
|
have experienced break-ins. The bulk of the problems have stemmed from
|
|||
|
|
hosts running tftpd, accounts with guessable passwords or no
|
|||
|
|
passwords, and known security holes not being patched.
|
|||
|
|
|
|||
|
|
The intruder, once in, gains root access and replaces key programs
|
|||
|
|
with ones that create log files which contain accounts and passwords in
|
|||
|
|
clear text. The intruder then returns and collects the file. By using
|
|||
|
|
accounts which are trusted on other systems, the intruder then installs
|
|||
|
|
replacement programs which start logging.
|
|||
|
|
|
|||
|
|
There have been many postings about the problem from several other net
|
|||
|
|
users. In addition to looking for setuid root programs in users' home
|
|||
|
|
directories, hidden directories '.. ' (dot dot space space), and a modified
|
|||
|
|
telnet program, we have received two reports from Ultrix 3.0 sites that
|
|||
|
|
the intruders are replacing the /usr/bin/login program. The Ultrix security
|
|||
|
|
hole being used in these attacks is only found in Ultrix 3.0.
|
|||
|
|
|
|||
|
|
Suggested steps:
|
|||
|
|
1) Check for a bogus /usr/bin/login. The sum program reports:
|
|||
|
|
27379 67 for VAX/Ultrix 3.0
|
|||
|
|
|
|||
|
|
2) Check for a bogus /usr/etc/telnetd. The sum program reports:
|
|||
|
|
23552 47 for VAX/Ultrix 3.0
|
|||
|
|
|
|||
|
|
3) Look for .savacct in either /usr/etc or in users' directories.
|
|||
|
|
This may be the file that the new login program creates. It
|
|||
|
|
could have a different name on your system.
|
|||
|
|
|
|||
|
|
4) Upgrade to Ultrix 3.1 ASAP.
|
|||
|
|
|
|||
|
|
5) Monitor accounts for users having passwords that can be found in
|
|||
|
|
the /usr/dict/words file or have simple passwords like a persons
|
|||
|
|
name or their account name.
|
|||
|
|
|
|||
|
|
6) Search through the file system for programs that are setuid root.
|
|||
|
|
|
|||
|
|
7) Disable or modify the tftpd program so that anonymous access to
|
|||
|
|
the file system is prevented.
|
|||
|
|
|
|||
|
|
If you find that a system that has been broken into, changing the password
|
|||
|
|
on the compromised account is not sufficient. The intruders do remove copies
|
|||
|
|
of the /etc/passwd file in order to break the remaining passwords. It is best
|
|||
|
|
to change all of the passwords at one time. This will prevent the intruders
|
|||
|
|
from using another account.
|
|||
|
|
|
|||
|
|
Please alert CERT if you do find a problem:
|
|||
|
|
|
|||
|
|
Computer Emergency Response Team
|
|||
|
|
Email: cert@sei.cmu.edu
|
|||
|
|
Telephone: 412-268-7090 (answers 24 hours a day)
|
|||
|
|
|
|||
|
|
For general questions, contact the SCC:
|
|||
|
|
|
|||
|
|
DDN Security Coordination Center
|
|||
|
|
Email: scc@nic.ddn.mil
|
|||
|
|
Telephone: 800-235-3155 (7 a.m. to 5 p.m. Pacific time)
|
|||
|
|
|
|||
|
|
**********************************************************************
|
|||
|
|
|
|||
|
|
Downloaded From P-80 International Information Systems 304-744-2253
|