-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>>                                                      CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl.  Links  <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>>                                                                           <<
>> CERT-NL also has stopped the CERT-CC-Mirror service.  Due to this the     <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the  <<
>> complete CERT-CC advisory texts:                     http://www.cert.org  <<
===============================================================================
===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : CERT-NL (Don Stikvoort)                     Index  :    S-94-24
Distribution  : World                                       Page   :          1
Classification: External                                    Version:      Final
Subject       : DEC ULTRIX and OSF/1 vulnerabilities        Date   :  23-Dec-94
===============================================================================
 
By courtesy of Digital Equipment Corporation and CERT/CC we received the
following information about DEC ULTRIX and OSF/1 vulnerabilities.

The information is dated 17-May-94 and has been issued by CERT-NL before in 
a compressed format as part of S-94-18 and S-94-18.APPENDIX of 15-Jul-94, the
latest advisory on "Sendmail Vulnerabilities". So there's nothing NEW to be 
read here, but because Digital's fixes concerned MORE than only Sendmail
the original Digital advisory is given here in full for those who did
NOT heed S-94-18, e.g. because they don't use Sendmail!

How to get other CERT-NL advisories and how to contact us, you will find 
at the very bottom of this document.
 
===============================================================================

SOURCE:  Digital Equipment Corporation  - ( DSIN / DSNlink FLASH MAIL )
         Software Security Response Team                              17.MAY.94

PRODUCT: ULTRIX        Versions 4.3, 4.3A, V4.4
         DECnet-ULTRIX Version 4.2
         DEC OSF/1     Versions 1.2, 1.3, 1.3A, 2.0

ADVISORY INFORMATION:

SUBJECT:  Security Enhanced Kit for DECNET-ULTRIX V4.2, ULTRIX V4.3 (VAX/RISC),
          ULTRIX V4.3A (RISC), ULTRIX V4.4 (VAX/RISC),
          ULTRIX Worksystem Software and DEC OSF/1 V1.2 - V2.0

IMPACT:   Potential security vulnerabilities exist where, under certain
          circumstances user access or privilege may be expanded.

SOLUTION: ULTRIX: Upgrade/Install ULTRIX to an minimum of V4.4 and install the
          Security Enhanced Kit

          DEC OSF/1: Upgrade/Install to a minimum of V1.2 and install
          the Security Enhanced Kit
          [Note: In the text below, Digital identifies OSF/1 V2.0 as the
          minimum. Digital has confirmed that 2.0 is correct. --CERT staff]

_______________________________________________________________________________
These kits are available from Digital Equipment Corporation by contacting your
normal Digital support channel or by request via DSNlink for electronic
transfer.
_______________________________________________________________________________

IMPACT:

Digital has discovered the existence of potential security vulnerabilities in
the ULTRIX V4.3, V4.3a, V4.4 and DEC OSF/1 V1.2, V1.3, V2.0 Operating Systems,
and DECnet-ULTRIX V4.2.  These potential vulnerabilities were discovered as a
result of evaluating recent reports of potential security vulnerabilities
which were distributed on the INTERNET and as a result of Digital's continued
engineering efforts.  The solutions to these vulnerabilities have been
included in the next release of ULTRIX and DEC OSF/1.

The kits have been created to correct potential security vulnerabilities
which, under certain circumstances may expand user access or privilege.

Digital Equipment Corporation strongly urges Customers to upgrade to a
minimum of ULTRIX V4.4 and DEC OSF/1 V2.0 then apply the Security Enhanced
Kit.  
        - Please refer to the applicable Release Note information prior to
          upgrading your installation.

_______________________________________________________________________________
KIT PART NUMBERS and DESCRIPTIONS

CSC PATCH #

CSCPAT_4060  V1.0   ULTRIX    V4.3 thru V4.4  (Includes DECnet-ULTRIX V4.2)
CSCPAT_4061  V1.0   DEC OSF/1 V1.2 thru V2.0

         _______________________________________________________________
         These kits will not install on versions previous to ULTRIX V4.3
         or DEC OSF/1 V1.2.
         _______________________________________________________________

_______________________________________________________________________________
_______________________________________________________________________________
The ULTRIX Security Enhanced kit replaces the following images:


/usr/etc/comsat                 ULTRIX V4.3, V4.3a, V4.4
/usr/ucb/lpr                    "                      "
/usr/bin/mail                   "                      "
/usr/lib/sendmail               "                      "

/usr/etc/telnetd                ULTRIX V4.3, V4.3a only

______________________________________
for DECnet-ULTRIX V4.2  installations:

/usr/etc/dlogind
/usr/etc/telnetd.gw
                *sendmail - is a previously distributed solution.

_______________________________________________________________________________
The DEC OSF/1 Security Enhanced kit replaces the following images:

/usr/sbin/comsat                DEC OSF/1 V1.2, V1.3 V2.0
/usr/bin/binmail
/usr/bin/lpr                    "                       "

/usr/sbin/sendmail              DEC OSF/1 V1.2, V1.3  only
/usr/bin/rdist                  "                       "
/usr/shlib/libsecurity.so       DEC OSF/1 V2.0 only
                *sendmail - is a previously distributed solution.
_______________________________________________________________________________

Digital urges you to periodically review your system management and
security procedures.  Digital will continue to review and enhance the
security features of its products and work with customers to maintain
and improve the security and integrity of their systems.
_______________________________________________________________________________

    NOTE: For non-contract/non-warranty customers contact your local Digital
          support channels for information regarding these kits.
______________________________________________________________________________

 
==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
  http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

   Email:     cert-nl@surfnet.nl     ATTENDED REGULARLY ALL DAYS
   Phone:     +31 302 305 305        BUSINESS HOURS ONLY
   Fax:       +31 302 305 329        BUSINESS HOURS ONLY
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands

NOODGEVALLEN:    06 22 92 35 64      ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64      ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6WGzSYjBqwfc9jEQJa6ACgvgPCgpyo4X5g0o5CN6dfYXK2fbwAnj+e
fxV8zbOcnz2R0NHBDK6kCzbp
=ZZDm
-----END PGP SIGNATURE-----