INFORMATION BULLETIN

E-24: Security Patch Kits for ULTRIX, DECnet-ULTRIX and OSF/1

May 18, 1994 1530 PDT


PROBLEM:   Digital Equipment Corporation has identified vulnerabilities
           in ULTRIX v4.3 and v4.4, DECnet-ULTRIX v4.2, and OSF/1 v1.2
           through v2.0.
PLATFORM:  Digital's VAX and RISC based workstations.
DAMAGE:    Users may obtain unauthorized access or privilege.
SOLUTION:  Upgrade software; install patches available from DEC.

VULNERABILITY   Similar vulnerabilities have been exploited on systems
ASSESSMENT:     connected to the Internet.  Digital recommends sites
                upgrade older versions and/or install the appropriate 
                fix immediately.

Critical Information about Vulnerabilities in ULTRIX, DECnet-ULTRIX and OSF/1

CIAC has been advised by the Software Security Response Team (SSRT) of Digital Equipment Corporation of security patches for their ULTRIX, DECnet-ULTRIX and OSF/1 products. SSRT requests that their advisory be reprinted without change [only minor corrections were necessary-ed].

============================  Begin SSRT Advisory  =============================
SOURCE:  Digital Equipment Corporation  - ( DSIN / DSNlink FLASH MAIL )
         Software Security Response Team                            17.MAY.94

PRODUCT: ULTRIX        Versions 4.3, 4.3A, V4.4
         DECnet-ULTRIX Version 4.2
         DEC OSF/1     Versions 1.2, 1.3, 1.3A, 2.0

ADVISORY INFORMATION:

SUBJECT:  Security Enhanced Kit for DECNET-ULTRIX V4.2,
          ULTRIX V4.3 (VAX/RISC), ULTRIX V4.3A (RISC), ULTRIX V4.4 (VAX/RISC), 
          ULTRIX Worksystem Software and DEC OSF/1 V1.2 - V2.0

IMPACT:   Potential security vulnerabilities exist where, under certain
          circumstances, user access or privilege may be expanded.

SOLUTION: ULTRIX: Upgrade/Install ULTRIX to a minimum of V4.4 and install
          the Security Enhanced Kit

          DEC OSF/1: Upgrade/Install to a minimum of V1.2 and install
          the Security Enhanced Kit


These kits are available from Digital Equipment Corporation by contacting
your normal Digital support channel or by request via DSNlink for electronic
transfer.

IMPACT:

Digital has discovered the existence of potential software security
vulnerabilities in the ULTRIX V4.3, V4.3a, V4.4 and DEC OSF/1 V1.2, V1.3,
V2.0 Operating Systems, and in DECnet-ULTRIX V4.2.  These potential
vulnerabilities were discovered as a result of evaluating recent reports of
potential security vulnerabilities which were distributed on the INTERNET
and as a result of Digital's continued engineering efforts.  The solutions
to these vulnerabilities have been included in the next release of ULTRIX
and DEC OSF/1. 

The kits have been created to correct potential software security
vulnerabilities which, under certain circumstances may expand user access
or privilege.

Digital Equipment Corporation strongly urges Customers to upgrade to a
minimum of ULTRIX V4.4 and DEC OSF/1 V2.0 then apply the Security Enhanced
Kit.
        - Please refer to the applicable Release Note information prior to
          upgrading your installation.


KIT PART NUMBERS and DESCRIPTIONS

CSC PATCH #

CSCPAT_4060  V1.0   ULTRIX    V4.3 thru V4.4  (Includes DECnet-ULTRIX V4.2)
CSCPAT_4061  V1.0   DEC OSF/1 V1.2 thru V2.0


         These kits will not install on versions previous to ULTRIX V4.3
         or DEC OSF/1 V1.2.

The ULTRIX Security Enhanced kit replaces the following images:


/usr/etc/comsat                 ULTRIX V4.3, V4.3a, V4.4
/usr/ucb/lpr                    "                      "
/usr/bin/mail                   "                      "
/usr/lib/sendmail               "                      "
                    *sendmail - is a previously distributed solution.

/usr/etc/telnetd                ULTRIX V4.3, V4.3a only


for DECnet-ULTRIX V4.2  installations:

/usr/etc/dlogind
/usr/etc/telnetd.gw


The DEC OSF/1 Security Enhanced kit replaces the following images:

/usr/sbin/comsat                DEC OSF/1 V1.2, V1.3 V2.0
/usr/bin/binmail
/usr/bin/lpr                    "                       "

/usr/sbin/sendmail              DEC OSF/1 V1.2, V1.3  only
                    *sendmail - is a previously distributed solution.
/usr/bin/rdist                  "                       "
/usr/shlib/libsecurity.so       DEC OSF/1 V2.0 only

Digital urges you to periodically review your system management and
security procedures.  Digital will continue to review and enhance the
security features of its products and work with customers to maintain
and improve the security and integrity of their systems.

    NOTE: For non-contract/non-warranty customers contact your local Digital
          support channels for information regarding these kits.

============================  End  SSRT  Advisory  =============================

CIAC wishes to thank Richard Boren of Digital Equipment Corporation's SSRT for providing the advisory used in this bulletin. DEC's SSRT can be contacted directly at 1-800-354-9000.

CIAC services are available to DOE, DOE Contractors, and the NIH. CIAC can be contacted at:

    Voice:          +1 925-422-8193 (7 x 24)
    FAX:            +1 925-423-8002
    STU-III:        +1 925-423-2604
    E-mail:          ciac@ciac.org
    World Wide Web:  http://www.ciac.org/
    Anonymous FTP:   ftp.ciac.org

This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes.

UCRL-MI-119788
[Privacy and Legal Notice]