************************************************************************** Security Bulletin 9712 DISA Defense Communications System June 2, 1997 Published by: DISN Security Coordination Center (SCC@NIC.MIL) 1-(800) 365-3642 DEFENSE INFORMATION SYSTEM NETWORK SECURITY BULLETIN The DISN SECURITY BULLETIN is distributed by the DISN SCC (Security Coordination Center) under DISA contract as a means of communicating information on network and host security exposures, fixes, and concerns to security and management personnel at DISN facilities. Back issues may be obtained via FTP from NIC.MIL [207.132.116.5] using login= "anonymous" and password="guest". The bulletin pathname is scc/sec-yynn (where "yy" is the year the bulletin is issued and "nn" is a bulletin number, e.g. scc/sec-9705.txt). These are also available at our WWW site, http://nic.mil. ************************************************************************** + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + ! ! ! The following important advisory was issued by the Automated ! ! Systems Security Incident Support Team (ASSIST) and is being ! ! relayed unedited via the Defense Information Systems Agency's ! ! Security Coordination Center distribution system as a means ! ! of providing DISN subscribers with useful security information. ! ! ! + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + -----BEGIN PGP SIGNED MESSAGE----- <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Automated Systems Security Incident Support Team _____ ___ ___ _____ ___ _____ | / /\ / \ / \ | / \ | | / Integritas / \ \___ \___ | \___ | | < et /____\ \ \ | \ | | \ Celeritas / \ \___/ \___/ __|__ \___/ | |_____\ <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Advisory: 97-04 Release date: 28 May 97 DESCRIPTION: Vulnerability in Xlock PLATFORM: See list of affected systems below IMPACT: A local user can execute commands as a privileged user RECOMMENDED SOLUTIONS: If your system is vulnerable, install vendor patches or apply the workaround described in Section III.B [ Beginning of CERT Bulletin ] ============================================================================= CERT* Advisory CA-97.13 Original issue date: May 7, 1997 Last revised: -- Topic: Vulnerability in xlock - - ----------------------------------------------------------------------------- The CERT Coordination Center has received reports that a buffer overflow condition exists in some implementations of xlock. This vulnerability makes it possible for local users (users with access to an account on the system) to execute arbitrary programs as a privileged user. Exploitation information involving this vulnerability has been made publicly available. If your system is vulnerable, the CERT/CC team recommends installing a patch from your vendor. If you are not certain whether your system is vulnerable or if you know that your system is vulnerable and you cannot add a patch immediately, we urge you to apply the workaround described in Section III.B. We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site. - - ----------------------------------------------------------------------------- I. Description xlock is a program that allows a user to "lock" an X terminal. A buffer overflow condition exists in some implementations of xlock. It is possible attain unauthorized access to a system by engineering a particular environment and calling a vulnerable version of xlock that has setuid or setgid bits set. Information about vulnerable versions must be obtained from vendors. Some vendor information can be found in Appendix A of this advisory. Exploitation information involving this vulnerability has been made publicly available. Note that this problem is different from that discussed in CERT Advisory CA-97.11.libXt. II. Impact Local users are able to execute arbitrary programs as a privileged user without authorization. III. Solution Install a patch from your vendor as described in Solution A. If you are not certain whether your system is vulnerable or if you know that your system is vulnerable and you cannot install a patch immediately, we recommend Solution B. A. Obtain and install a patch for this problem. Below is a list of vendors who have provided information about xlock. Details are in Appendix A of this advisory; we will update the appendix as we receive more information. If your vendor's name is not on this list, the CERT/CC did not hear from that vendor. Please contact your vendor directly. Berkeley Software Design, Inc. (BSDI) Cray Research - A Silicon Graphics Company Data General Corporation Digital Equipment Corporation FreeBSD, Inc. Hewlett-Packard Company IBM Corporation LINUX NEC Corporation The Open Group [This group distributes the publicly available software that was formerly distributed by X Consortium] Solbourne Sun Microsystems, Inc. B. We recommend the following workaround if you are not certain whether your system is vulnerable or if you know that your system is vulnerable and you cannot install a patch immediately. 1. Find and disable any copies of xlock that exist on your system and that have the setuid or setgid bits set. 2. Install a version of xlock known to be immune to this vulnerablility. One such supported tool is xlockmore. The latest version of this tool is 4.02, and you should ensure that this is the version you are using. This utility can be obtained from the following site: ftp://ftp.x.org/contrib/applications/xlockmore-4.02.tar.gz MD5 (xlockmore-4.02.tar.gz) = c158e6b4b99b3cff4b52b39219dbfe0e You can also obtain this version from mirror sites. A list of these sites will be displayed if you are not able to access the above archive due to load. ........................................................................... Appendix A - Vendor Information Below is a list of the vendors who have provided information for this advisory. We will update this appendix as we receive additional information. If you do not see your vendor's name, the CERT/CC did not hear from that vendor. Please contact the vendor directly. Berkeley Software Design, Inc. (BSDI) ===================================== BSD/OS is not vulnerable to the problem in xlock since our xlock is not setuid. Cray Research - A Silicon Graphics Company ========================================== Cray Research does not include xlock in its X Window releases, so we are not at risk on the xlock buffer overflow problem. Data General Corporation ======================== The xlock sources (xlockmore-3.7) that DG includes in its contributed software package have been modified to remove this vulnerability. These will be available when release 8 comes out. We also recommend that our customers who have the current version should change the sprintf calls in resource.c to snprintf calls, rebuild and reinstall the package. Digital Equipment Corporation ============================= This reported problem is not present for Digital's ULTRIX or Digital UNIX Operating Systems Software. FreeBSD, Inc. ============= The xlockmore version we ship in our ports collection is vulnerable in all shipped releases. The port in FreeBSD-current is fixed. Solution is to install the latest xlockmore version (4.02). Hewlett-Packard Company ======================= We ship an suid root program vuelock that is based on xlock. It does have the vulnerability. The only workaround is to remove the executable, the patch is "in process". IBM Corporation =============== AIX is vulnerable to the conditions described in this advisory. The following APARs will be released soon: AIX 3.2: APAR IX68189 AIX 4.1: APAR IX68190 AIX 4.2: APAR IX68191 IBM and AIX are registered trademarks of International Business Machines Corporation. LINUX ===== Red Hat: Not vulnerable Caldera: Not vulnerable Debian: An updated package is on the Debian site SuSE: ftp://ftp.suse.com/pub/SuSE-Linux/suse_update/S.u.S.E.-4.4.1/xap1/xlock And in general the new Xlockmore release fixes the problems. NEC Corporation =============== UX/4800 Not vulnerable for all versions. EWS-UX/V(Rel4.2MP) Not vulnerable for all versions. EWS-UX/V(Rel4.2) Not vulnerable for all versions. UP-UX/V(Rel4.2MP) Not vulnerable for all versions. The Open Group ============== Publicly available software that was formerly distributed by the X Consortium - Not vulnerable. Solbourne ========= Solbourne is not vulnerable to this attack. Sun Microsystems, Inc. ====================== We are producing patches for OpenWindows 3.0 for Sun OS versions 4.1.3_U1, 4.1.4, 5.3, 5.4, 5.5, and 5.5.1. [ End of CERT Bulletin ] - ------------------------------------------------------------------------------ The ASSIST staff would like to thank the CERT Coordination Center for this bulletin as well as David Hedley for reporting the original problem and Kaleb Keithley at The Open Group for his support in the development of this advisory. - ------------------------------------------------------------------------------ <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ASSIST is an element of the Defense Information Systems Agency (DISA), Global Operations and Security Center (GOSC), which provides service to the entire DoD community. Constituents of the DoD with questions about ASSIST or computer security issues, can contact ASSIST using one of the methods listed below. Non-DoD organizations/institutions, contact the Forum of Incident Response and Security Teams (FIRST) representative. To obtain a list of FIRST member organizations and their constituencies send an email to docserver@first.org with an empty "subject" line and a message body containing the line "send first-contacts". ___________________________ ASSIST CONTACT INFORMATION: E-mail: assist@assist.mil Phone: (800)-357-4231 (DSN 327-4700) 24 hour hotline Fax: (703) 607-4735 (DSN 327-4735) Unclassified ASSIST Bulletins, tools and other security related information are available from: http://www.assist.mil/ ftp://ftp.assist.mil/ To be added to our mailing list for ASSIST bulletins, send your e-mail address to: assist-request@assist.mil In the subject line, type: SUBSCRIBE ___________________________________ OTHER DOD CERT CONTACT INFORMATION: Air Force CERT Phone: (800) 854-0187 Air Force CERT Email: afcert@afcert.csap.af.mil Navy CIRT Phone: (800) 628-8893 Navy CIRT Email: navcirt@fiwc.navy.mil Army CERT Phone: (888) 203-6332 Army CERT Email: acert@vulcan.belvoir.army.mil _________________ ASSIST BULLETINS: Back issues of ASSIST bulletins, and other security related information, are available from the ASSIST BBS at 703-607-4710, 327-4710, and through anonymous FTP from ftp.assist.mil (IP address 199.211.123.12). Note: ftp.assist.mil will only accept anonymous FTP connections from Milnet addresses that are registered with the NIC or DNS. If your system is not registered, you must provide your MILNET IP address to ASSIST before access can be provided. ASSIST uses Pretty Good Privacy (PGP) as the digital signature mechanism for bulletins. PGP incorporates the RSAREF(tm) Cryptographic Toolkit under license from RSA Data Security, Inc. A copy of that license is available via anonymous FTP from net-dist.mit.edu (IP 18.72.0.3) in the file /pub/PGP/rsalicen.txt. In accordance with the terms of that license, PGP may be used for non-commercial purposes only. Instructions for downloading the PGP software can also be obtained from net-dist.mit.edu in the pub/PGP/README file. PGP and RSAREF may be subject to the export control laws of the United States of America as implemented by the United States Department of State Office of Defense Trade Controls. The PGP signature information will be attached to the end of ASSIST bulletins. Reference herein to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by ASSIST. The views and opinions of authors expressed herein shall not be used for advertising or product endorsement purposes. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBM4x2UtH6sbnW3Io9AQEiHAP/ZB0jBngG26TAOmP3pVaasPw3ejLGGAOG BXRB30nKPwwcBnmYpfQUADm7OGCTJykhwOZ+/rcRNhBAN/6nhZuFx87XFB/oMQZ6 fr1fwMCgWiD+UFYq6yopjCBXyO1UR0FPWotS/ZrWMdzS14JsjyevujVR59pVBKKA gaKwBnYPt7Q= =l9H8 -----END PGP SIGNATURE----- **************************************************************************** * * * The point of contact for NIPRNET security-related incidents is the * * ASSIST: * * * * E-mail address: ASSIST@ASSIST.MIL * * * * Telephone: 1-(800)-357-4231 (24 hours/day) * * * * You may also contact the Security Coordination Center (SCC) at the * * NIC: * * * * E-mail address: SCC@NIC.MIL * * * * Telephone: 1-(800)-365-3642 * * * * NIC Help Desk personnel are available from 7:00 a.m.-7:00 p.m. EST, * * Monday through Friday except on federal holidays. * * * **************************************************************************** PLEASE NOTE: Some users outside of the DOD computing communities may receive DISN Security Bulletins. If you are not part of the DOD community, please contact your agency's incident response team to report incidents. Your agency's team will coordinate with DOD. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver@first.org with an empty subject line and a message body containing the line: send first-contacts. This document was prepared as an service to the DOD community. Neither the United States Government nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government. The opinions of the authors expressed herein do not necessarily state or reflect those of the United States Government, and shall not be used for advertising or product endorsement purposes.