201 lines
8.5 KiB
Plaintext
201 lines
8.5 KiB
Plaintext
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
|
|
/* *\
|
|
/ * * \
|
|
/ * * \
|
|
/ * * \
|
|
/ * System Vulnerabilities * \
|
|
| * * |
|
|
| * * |
|
|
| * * |
|
|
| * Another Modernz Presentation * |
|
|
| * * |
|
|
\ * by * /
|
|
\ * Multiphage * /
|
|
\ * * /
|
|
\ * (C)opyright August 5th, 1992 * /
|
|
\ * */
|
|
*********************************************************
|
|
|
|
|
|
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
|
|
*******************************************************************************
|
|
The Modernz can be contacted at:
|
|
|
|
MATRIX BBS
|
|
WOK-NOW!
|
|
World of Kaos NOW!
|
|
World of Knowledge NOW!
|
|
St. Dismis Institute
|
|
- Sysops: Wintermute
|
|
Digital-demon
|
|
(908) 905-6691
|
|
(908) WOK-NOW!
|
|
(908) 458-xxxx
|
|
1200/2400/4800/9600
|
|
14400/19200/38400
|
|
Home of Modernz Text Philez
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
|
|
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
|
|
|
|
TANSTAAFL
|
|
Pheonix Modernz
|
|
The Church of Rodney
|
|
- Sysop: Tal Meta
|
|
(908) 830-TANJ
|
|
(908) 830-8265
|
|
Home of TANJ Text Philez
|
|
|
|
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
|
|
|
|
CyberChat
|
|
Sysop: Hegz
|
|
(908)506-6651
|
|
(908)506-7637
|
|
300/1200/2400/4800/9600
|
|
14400/19200/38400
|
|
Modernz Site
|
|
TLS HQ
|
|
|
|
<><><><><><><><><><><><><><<><<><><><><><><><><><><><><><><><><><><><><><><><><
|
|
|
|
The Global Intelligence Center
|
|
World UASI Headquarters!
|
|
Pennsylvania SANsite!
|
|
(412) 475-4969 300/1200/2400/9600
|
|
24 Hours! SysOp: The Road Warrior
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
|
|
|
|
The Lost Realm
|
|
Western PA UASI site!
|
|
Western PA. SANfranchise
|
|
(412) 588-5056 300/1200/2400
|
|
SysOp: Orion Buster
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
|
|
|
|
The Last Outpost
|
|
PowerBBS Support Board
|
|
UASI ALPHA Division
|
|
NorthWestern PA UASI site!
|
|
(412) 662-0769 300/1200/2400
|
|
24 hours! SysOp: The Almighty Kilroy
|
|
|
|
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
|
|
|
|
Hellfire BBS
|
|
SANctuary World Headquarters!
|
|
New Jersey UASI site!
|
|
(908) 495-3926 300/1200/2400
|
|
24 hours! SysOp: Red
|
|
|
|
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
|
|
|
|
BlitzKreig BBS
|
|
Home of TAP
|
|
(502)499-8933
|
|
|
|
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
|
|
|
|
|
|
|
|
|
|
===========================================================================
|
|
AT&T /usr/etc/rexecd Vulnerability
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
Information concerning a vulnerability in AT&T TCP/IP Release 4.0
|
|
running on SVR4 systems for both the 386/486 and 3B2 RISC platforms.
|
|
|
|
The existing error, in the remote execution server /usr/etc/rexecd, has
|
|
been corrected, and a new executable for rexecd is available from AT&T
|
|
by calling 800-543-9935. Patches may be obtained outside the U.S. by
|
|
calling your local technical support. The numbers associated with the
|
|
fix are 5127 (3.5" media) and 5128 (5.25" media).
|
|
|
|
The problem does not exist in TCP/IP release 3.2 for SVR3, or any earlier
|
|
versions of the TCP/IP product running on either the 3B2 or 386 platforms.
|
|
|
|
The version of TCP/IP distributed with SVR4 by UNIX(r) System Laboratories,
|
|
Inc. (a subsidiary of AT&T) does not contain this vulnerability.
|
|
|
|
UNIX(r) is a registered trademark of UNIX System Laboratories, Inc.
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
I. Description
|
|
|
|
A vulnerability has been identified where root privileges may be
|
|
accessed through the use of /usr/etc/rexecd.
|
|
|
|
II. Impact
|
|
|
|
A user on a remote machine may be able to run commands as root on
|
|
the target host (the host running the affected /usr/etc/rexecd).
|
|
|
|
III. Solution
|
|
|
|
1. Administrators of affected systems should execute, as root, the
|
|
following command to immediately turn off access to rexecd until
|
|
the new binary can be obtained.
|
|
|
|
# chmod 400 /usr/etc/rexecd
|
|
|
|
2. Obtain and install the new patch. The fix will be supplied as
|
|
one diskette, and it comes with one page of instructions documenting
|
|
the procedure to replace the existing /usr/etc/rexecd binary.
|
|
|
|
|
|
---------------------------------------------------------------------------
|
|
AIX REXD Daemon Vulnerability
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
Information concerning a vulnerability with the rexd daemon
|
|
in versions 3.1 and 3.2 of AIX for IBM RS/6000 machines.
|
|
|
|
IBM is aware of the problem and it will be fixed in future updates to
|
|
AIX 3.1 and 3.2. Sites may call IBM Support (800-237-5511) and ask for
|
|
the patch for apar ix21353. Patches may be obtained outside the U.S. by
|
|
contacting your local IBM representative.
|
|
|
|
The fix is also provided below.
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
I. Description
|
|
|
|
In certain configurations, particularly if NFS is installed,
|
|
the rexd (RPC remote program execution) daemon is enabled.
|
|
|
|
Note: Installing NFS with the current versions of "mknfs" will
|
|
re-enable rexd even if it was previously disabled.
|
|
|
|
II. Impact
|
|
|
|
If a system allows rexd connections, anyone on the Internet can
|
|
gain access to the system as a user other than root.
|
|
|
|
III. Solution
|
|
|
|
CERT/CC and IBM recommend that sites take the following actions
|
|
immediately. These steps should also be taken whenever "mknfs" is run.
|
|
|
|
1. Be sure the rexd line in /etc/inetd.conf is commented out by
|
|
having a '#' at the beginning of the line:
|
|
|
|
#rexd sunrpc_tcp tcp wait root /usr/etc/rpc.rexd rexd 100017 1
|
|
|
|
2. Refresh inetd by running the following command as root:
|
|
|
|
refresh -s inetd
|
|
|
|
|