**************************************************************************

Security Bulletin 9728 DISA Defense Communications System

December 3, 1997 Published by: DISN Security Coordination Center

(SCC@NIC.MIL) 1-(800) 365-3642

DEFENSE INFORMATION SYSTEM NETWORK

SECURITY BULLETIN

The DISN SECURITY BULLETIN is distributed by the DISN SCC (Security Coordination Center) under DISA contract as a means of communicating information on network and host security exposures, fixes, and concerns to security and management personnel at DISN facilities. Back issues may be obtained via FTP from NIC.MIL [207.132.116.5] using login= "anonymous" and password="guest". The bulletin pathname is scc/sec-yynn (where "yy" is the year the bulletin is issued and "nn" is a bulletin number, e.g. scc/sec-9705.txt). These are also available at our WWW site, http://nic.mil.

**************************************************************************

+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

! !

! The following important advisory was issued by the Computer !

! Emergency Response Team (CERT) and is being relayed unedited !

! via the Defense Information Systems Agency's Security !

! Coordination Center distribution system as a means of !

! providing DISN subscribers with useful security information. !

! !

+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

=============================================================================

-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================

CERT* Vendor-Initiated Bulletin VB-97.15

December 2, 1997

To aid in the wide distribution of essential security information, the CERT Coordination Center is forwarding the following information from Sun Microsystems, Inc. Sun urges you to act on this information as soon as possible. Sun contact information is included in the forwarded text below; please contact them if you have any questions or need further information.

Please note that since the original publication of this information by Sun Microsystems, some of the patches have been updated. Patch number 101973 has been updated to revision 33 (101973-33), and patch number 101974 has been updated to revision 33 (101974-33). MD5 checksums are shown below:

Filename MD5

-------------- -------------------

101973-33.tar.Z e10592771e9c8c8673277aa2d4637326

101974-33.tar.Z 1ad5395c8dec847f646337ebf087f2c0

These patches are also available at

<URL:ftp://sunsolve1.sun.com/pub/patches/patches.html>

=======================FORWARDED TEXT STARTS HERE============================

- -----BEGIN PGP SIGNED MESSAGE-----

________________________________________________________________________________

Sun Microsystems, Inc. Security Bulletin

Bulletin Number: #00155

Date: October 28, 1997

Cross-Ref:

Title: nis_cachemgr

________________________________________________________________________________

Permission is granted for the redistribution of this Bulletin, so long as the Bulletin is not edited and is attributed to Sun Microsystems. Portions may also be excerpted for re-use in other security advisories so long as proper attribution is included.

Any other use of this information without the express written consent of Sun Microsystems is prohibited. Sun Microsystems expressly disclaims all liability for any misuse of this information by any third party.

________________________________________________________________________________

1. Bulletins Topics

Sun announces the release of patches for Solaris 2.5.1, 2.5, and 2.4 (SunOS 5.5.1, 5.5, and 5.4) which relate to a vulnerability in nis_cachemgr.

Sun estimates that the release of a patch for Solaris 2.3 (SunOS 5.3) that relate to the same vulnerability will be available within 4 weeks of the date of this bulletin.

Sun strongly recommends that you install the patches listed in section 4 immediately on systems running SunOS 5.5.1, 5.5, and 5.4 which use NIS+.

2. Who is Affected

Vulnerable: SunOS versions 5.5.1, 5.5.1_x86, 5.5, 5.5_x86,

5.4, 5.4_x86, 5.3

Not vulnerable: All other supported versions of SunOS.

The vulnerability does not exist in Solaris 2.6.

3. Understanding the Vulnerability

NIS+ clients run nis_cachemgr, a NIS+ utility that caches location information about NIS+ servers. This vulnerability, if exploited, allows attackers to add bogus directory objects to the global shared cache, in effect specifying rogue NIS+ servers that are under their control.

4. List of Patches

The vulnerability in nis_cachemgr is fixed by the following patches:

OS version Patch ID

__________ ________

SunOS 5.5.1 103612-33

SunOS 5.5.1_x86 103613-32

SunOS 5.5 103187-29

SunOS 5.5_x86 103188-29

SunOS 5.4 101973-32

SunOS 5.4_x86 101974-32

SunOS 5.3 101318-89 (to be released in 4 weeks)

5. Checksum Table

The checksum table below shows the BSD checksums (SunOS 5.x: /usr/ucb/sum), SVR4 checksums (SunOS 5.x: /usr/bin/sum), and the MD5 digital signatures for the above-mentioned patches that are available from:

<URL:ftp://sunsolve1.sun.com/pub/patches/patches.html>

These checksums may not apply if you obtain patches from your answer centers.

File Name BSD SVR4 MD5

_______________ __________ __________ ________________________________

103612-33.tar.Z 42409 3248 60555 6495 63408A137DBE6BEEDAECFA49674F0E5A

103613-32.tar.Z 08972 2939 41390 5878 E613588ADA2845DA2CEDE801FE247ED2

103187-29.tar.Z 47938 3240 14585 6479 D681C0BB1C4267418AEB20F56DDE7FD3

103188-29.tar.Z 36871 2919 14150 5838 F7184B433BF9EDCBA99E81D2039F355A

101973-32.tar.Z 55144 956 44485 1911 A802DA901090B52A27BDC6AE0D386C13

101974-32.tar.Z 41770 826 48991 1652 91AB26639B6CB0902ADE354999751826

______________________________________________________________________________

APPENDICES

A. Patches listed in this bulletin are available to all Sun customers via

World Wide Web at:

<URL:ftp://sunsolve1.sun.com/pub/patches/patches.html>

Customers with Sun support contracts can also obtain patches from local Sun answer centers and SunSITEs worldwide.

B. Sun security bulletins are available via World Wide Web at:

<URL:http://sunsolve1.sun.com/sunsolve/secbulletins>

C. Sun Security Coordination Team's PGP key is available via World Wide Web

at:

<URL:http://sunsolve1.sun.com/sunsolve/secbulletins/SunSCkey.txt>

D. To report or inquire about a security problem with Sun software, contact

one or more of the following:

• Your local Sun answer centers
• Your representative computer security response team, such as CERT
• Sun Security Coordination Team. Send email to:

E. To receive information or subscribe to our CWS (Customer Warning System)

mailing list, send email to:

security-alert@sun.com

with a subject line (not body) containing one of the following commands:

Command Information Returned/Action Taken

_______ _________________________________

help An explanation of how to get information

key Sun Security Coordination Team's PGP key

list A list of current security topics

query [topic] The email is treated as an inquiry and is forwarded to

the Security Coordination Team

report [topic] The email is treated as a security report and is

forwarded to the Security Coordinaton Team. Please

encrypt sensitive mail using Sun Security Coordination

Team's PGP key

send topic A short status summary or bulletin. For example, to

retrieve a Security Bulletin #00138, supply the

following in the subject line (not body):

send #138

subscribe Sender is added to our mailing list. To subscribe,

supply the following in the subject line (not body):

subscribe cws your-email-address

Note that your-email-address should be substituted by your email address.

unsubscribe Sender is removed from the CWS mailing list.

________________________________________________________________________________

========================FORWARDED TEXT ENDS HERE=============================

If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in the Forum of Incident Response and Security Teams (FIRST). See http://www.first.org/team-info/.

We strongly urge you to encrypt any sensitive information you send by email. The CERT Coordination Center can support a shared DES key and PGP. Contact the CERT staff for more information.

Location of CERT PGP key

ftp://ftp.cert.org/pub/CERT_PGP.key

CERT Contact Information

- ------------------------

Email cert@cert.org

Phone +1 412-268-7090 (24-hour hotline)

CERT personnel answer 8:30-5:00 p.m. EST

(GMT-5)/EDT(GMT-4), and are on call for

emergencies during other hours.

Fax +1 412-268-6989

Postal address

CERT publications, information about FIRST representatives, and other

security-related information are available from

CERT advisories and bulletins are also posted on the USENET newsgroup

comp.security.announce

To be added to our mailing list for CERT advisories and bulletins, send your

email address to

cert-advisory-request@cert.org

In the subject line, type

SUBSCRIBE your-email-address

• Registered U.S. Patent and Trademark Office.

The CERT Coordination Center is part of the Software Engineering Institute (SEI). The SEI is sponsored by the U. S. Department of Defense.

This file: ftp://ftp.cert.org/pub/cert_bulletins/VB-97.15.nis_cachemgr

****************************************************************************

* *

• The point of contact for NIPRNET security-related incidents is the *
• ASSIST: *

* *

• E-mail address: ASSIST@ASSIST.MIL *

* *

• Telephone: 1-(800)-357-4231 (24 hours/day) *

* *

• You may also contact the Security Coordination Center (SCC) at the *
• NIC: *

* *

• E-mail address: SCC@NIC.MIL *

* *

• Telephone: 1-(800)-365-3642 *

* *

• NIC Help Desk personnel are available from 7:00 a.m.-7:00 p.m. EST, *
• Monday through Friday except on federal holidays. *

* *

****************************************************************************

PLEASE NOTE: Some users outside of the DOD computing communities may receive DISN Security Bulletins. If you are not part of the DOD community, please contact your agency's incident response team to report incidents. Your agency's team will coordinate with DOD. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver@first.org with an empty subject line and a message body containing the line: send first-contacts.

This document was prepared as an service to the DOD community. Neither the United States Government nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government. The opinions of the authors expressed herein do not necessarily state or reflect those of the United States Government, and shall not be used for advertising or product endorsement purposes.