126 lines
3.9 KiB
Plaintext
126 lines
3.9 KiB
Plaintext
|
|
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
|
|
CA-90:07 CERT Advisory
|
|
October 25, 1990
|
|
VMS ANALYZE/PROCESS_DUMP
|
|
|
|
- -------------------------------------------------------------------------
|
|
|
|
The CERT/CC has received a report of a security vulnerability which
|
|
exists under specific conditions in Digital VMS Software (Versions 4.0
|
|
to 5.4). The DESCRIPTION, IMPACT, SOLUTION, and CONTACT INFORMATION
|
|
sections below have been provided to the CERT/CC by the Digital Equipment
|
|
Corporation.
|
|
|
|
- -------------------------------------------------------------------------
|
|
DESCRIPTION:
|
|
|
|
Non-privileged users can acquire system privileges through
|
|
the ANALYZE/PROCESS_DUMP routine.
|
|
|
|
|
|
IMPACT:
|
|
|
|
Non-privileged users who gain increased privileges might deliberately
|
|
or inadvertently affect the integrity of system information and/or
|
|
affect the integrity of the computing resource.
|
|
|
|
SOLUTION:
|
|
|
|
Digital is currently working on a permanent solution to this
|
|
problem. While a permanent fix is being completed, Digital
|
|
recommends that the following actions be taken on every VMS
|
|
system (this includes all nodes in a VAXcluster system).
|
|
|
|
|
|
After taking the following actions, non-privileged users will not be able
|
|
to use the ANALYZE/PROCESS_DUMP command.
|
|
|
|
1. Log into the system account.
|
|
|
|
2. $ SET PROC/PRIV=ALL
|
|
|
|
3. a) For VMS versions prior to V5.0,
|
|
|
|
Modify SYS$MANAGER:SYSTARTUP.COM to include the following lines:
|
|
|
|
$ SET NOON
|
|
$ MCR INSTALL ANALIMDMP.EXE/DELETE
|
|
|
|
as the first two commands in this file.
|
|
|
|
b) For VMS versions V5.0 and later,
|
|
|
|
Modify SYS$MANAGER:SYSTARTUP_V5.COM to include the following
|
|
lines:
|
|
|
|
$ SET NOON
|
|
$ MCR INSTALL ANALIMDMP.EXE/DELETE
|
|
|
|
as the first two commands in this file.
|
|
|
|
c) For MicroVMS systems,
|
|
|
|
The image ANALIMDMP.EXE is not installed by default, but
|
|
SYSTARTUP.COM contains a suggestion for installing the image if
|
|
you have multiple users on your system. You must ensure that
|
|
this image is not installed by SYSTARTUP.COM. You can use the
|
|
following command to verify that the image is not installed:
|
|
|
|
$ MCR INSTALL ANALIMDMP/LIST
|
|
|
|
4. $ MCR INSTALL ANALIMDMP/DELETE
|
|
|
|
This command removes the installed image from the active system.
|
|
|
|
5. (Optional) Restart your systems and verify that the image is not
|
|
installed using the following command:
|
|
|
|
$ MCR INSTALL ANALIMDMP/LIST
|
|
|
|
You should receive a message similar to the following:
|
|
|
|
%INSTALL-W-FAIL, failed to LIST entry for ANALIMDMP.EXE
|
|
-INSTALL-E-NOKFEFND, Known File Entry not found
|
|
|
|
|
|
CONTACT INFORMATION:
|
|
|
|
For further questions, please contact your Digital Customer Support
|
|
Center.
|
|
|
|
- -------------------------------------------------------------------------
|
|
|
|
The CERT/CC thanks Digital for the information above, and thanks Clive
|
|
Walmsley, Royal Signal and Radar Establishment, Malvern England, for
|
|
reporting this problem to CERT/CC.
|
|
|
|
- -------------------------------------------------------------------------
|
|
|
|
Computer Emergency Response Team/Coordination Center (CERT/CC)
|
|
Software Engineering Institute
|
|
Carnegie Mellon University
|
|
Pittsburgh, PA 15213-3890
|
|
|
|
Internet E-mail: cert@cert.org
|
|
Telephone: 412-268-7090 24-hour hotline: CERT personnel answer
|
|
7:30a.m.-6:00p.m. EST, on call for
|
|
emergencies other hours.
|
|
|
|
Past advisories and other information are available for anonymous ftp
|
|
from cert.org (192.88.209.5).
|
|
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBMaMwiHVP+x0t4w7BAQEgdwP/ZZJtSRmeNqdt3GnOiy03hvngASV1YGdt
|
|
gL3RedKEZ5Fvqn5TwJ3mGsroBQbahcv64OPGQCqVHHDSGtPbJny/1W1Mku9R7XaW
|
|
I+H0Don2sdM2juGkv531Ta+o1oA+UQBHc3C2b9cxVpOy7PEewACVL73x6f+s8Pg+
|
|
LQRwJ57JM50=
|
|
=MB7l
|
|
-----END PGP SIGNATURE-----
|
|
|