119 lines
5.0 KiB
Plaintext
119 lines
5.0 KiB
Plaintext
|
|
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
===========================================================================
|
|
CA-92:13 CERT Advisory
|
|
June 4, 1992
|
|
SunOS NIS Vulnerability
|
|
- ---------------------------------------------------------------------------
|
|
|
|
The Computer Emergency Response Team/Coordination Center (CERT/CC) has
|
|
received information concerning several vulnerabilities with NIS under
|
|
Sun Microsystems, Inc. SunOS. These vulnerabilities exist in NIS under
|
|
SunOS 4.1, 4.1.1, and 4.1.2, and may or may not exist in earlier versions
|
|
of NIS.
|
|
|
|
Sun has provided fixes for SunOS 4.1, 4.1.1, and 4.1.2 for these
|
|
vulnerabilities. The patch file containing these fixes is available
|
|
through your local Sun Answer Center and through anonymous ftp from
|
|
ftp.uu.net (137.39.1.9) in the /systems/sun/sun-dist directory. Note
|
|
that these fixes will probably not be compatible with SunOS 4.0.3 and
|
|
earlier versions of the operating system.
|
|
|
|
Fix PatchID Filename Checksum
|
|
/usr/etc/{ypserv,ypxfrd,portmap} 100482-2 100482-02.tar.Z 53416 284
|
|
|
|
Please note that Sun will occasionally update patch files. If you
|
|
find that the checksum is different, please contact Sun or the CERT/CC
|
|
for verification.
|
|
|
|
- ---------------------------------------------------------------------------
|
|
|
|
I. Description
|
|
|
|
A security vulnerability exists under NIS allowing unauthorized access
|
|
to NIS information.
|
|
|
|
II. Impact
|
|
|
|
A user on a remote host can obtain copies of the NIS maps from a
|
|
system running NIS. The remote user can attempt to guess passwords
|
|
for the system using the obtained NIS password map information.
|
|
|
|
III. Solution
|
|
|
|
A. Obtain and install the patch from Sun or from ftp.uu.net following
|
|
the instructions provided in the "README" file.
|
|
|
|
1. As root, rename the existing versions of
|
|
/usr/etc/{ypserv,ypxfrd,portmap} and modify the
|
|
permissions to prevent misuse.
|
|
|
|
# mv /usr/etc/ypserv /usr/etc/ypserv.orig
|
|
# mv /usr/etc/ypxfrd /usr/etc/ypxfrd.orig
|
|
# mv /usr/etc/portmap /usr/etc/portmap.orig
|
|
# chmod 0400 /usr/etc/ypserv.orig
|
|
# chmod 0400 /usr/etc/ypxfrd.orig
|
|
# chmod 0400 /usr/etc/portmap.orig
|
|
|
|
2. Copy the new binaries into the /usr/etc directory.
|
|
|
|
# cp `arch`/{4.1, 4.1.1, 4.1.2}/ypserv /usr/etc/ypserv
|
|
# cp `arch`/{4.1, 4.1.1, 4.1.2}/ypxfrd /usr/etc/ypxfrd
|
|
# cp `arch`/{4.1, 4.1.1, 4.1.2}/portmap /usr/etc/portmap
|
|
# chown root /usr/etc/ypserv /usr/etc/ypxfrd /usr/etc/portmap
|
|
# chmod 755 /usr/etc/ypserv /usr/etc/ypxfrd /usr/etc/portmap
|
|
|
|
3. Copy the securenets file to the /var/yp directory. Any
|
|
site that has an existing /var/yp/securenets file should
|
|
rename it prior copying the new version of the file.
|
|
|
|
# cp `arch`/{4.1, 4.1.1, 4.1.2}/securenets /var/yp
|
|
# chown root /var/yp/securenets
|
|
# chmod 644 /var/yp/securenets
|
|
|
|
4. Edit the /var/yp/securenets file to reflect the correct
|
|
configuration for your site. See the "README" file for
|
|
details of the file syntax and special instructions for
|
|
hosts with multiple Ethernet interfaces. The file should
|
|
not contain any blank lines.
|
|
|
|
5. Reboot the system to invoke the new binaries.
|
|
|
|
- ---------------------------------------------------------------------------
|
|
The CERT/CC would like to thank Casper Dik of the University of Amsterdam,
|
|
The Netherlands, and Peter Lamb of the Division of Information Technology,
|
|
Commonwealth Scientific and Industrial Research Organization, Australia,
|
|
for their assistance. We also wish to thank Sun Microsystems, Inc. for
|
|
their response to this vulnerability.
|
|
- ---------------------------------------------------------------------------
|
|
|
|
If you believe that your system has been compromised, contact CERT/CC or
|
|
your representative in FIRST (Forum of Incident Response and Security Teams).
|
|
|
|
Internet E-mail: cert@cert.org
|
|
Telephone: 412-268-7090 (24-hour hotline)
|
|
CERT/CC personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4),
|
|
on call for emergencies during other hours.
|
|
|
|
Computer Emergency Response Team/Coordination Center (CERT/CC)
|
|
Software Engineering Institute
|
|
Carnegie Mellon University
|
|
Pittsburgh, PA 15213-3890
|
|
|
|
Past advisories, information about FIRST representatives, and other
|
|
information related to computer security are available for anonymous ftp
|
|
from cert.org (192.88.209.5).
|
|
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBMaMxAXVP+x0t4w7BAQEhoAQAhpzvA96DgvdSdICkK4NriqBIXZZ5hNu9
|
|
+UFn5/4b74tJve4VGtT3yBg8BoauXLQzMqjg4lLSBpfcpm15haahHTgIbEhZuDbT
|
|
PZQzVvWhs1rLSwWXGAOMt5eE74TH5qgD0JW2A0qMBxEyIMnY1OeKBWGk/GU7CYMy
|
|
ModJJ04PDlA=
|
|
=R9tG
|
|
-----END PGP SIGNATURE-----
|
|
|