=============================================================================
SA-94.02      SERT Advisory
         27-May-1994
    Ultrix, DECnet-Ultrix, OSF/1 vulnerabilities
-----------------------------------------------------------------------------

The Security Emergency Response Team has received information from Digital
Equipment Corporation concerning a security vulnerability in several
versions of the ULTRIX operating system. The entire DEC bulletin is
reproduced verbatim below, as per the company's request.

    ADVISORY INFORMATION:

           SUBJECT: Security Enhanced Kit for ULTRIX V4.3 (VAX/RISC),
                    ULTRIX V4.3A (RISC), ULTRIX V4.4, ULTRIX Worksystem
                    Software and DEC OSF/1 V1.2 - V2.0 Operating Systems.

            IMPACT: Potential security vulnerabilities exist where,
                    under certain circumstances user access or privilege
                    may be expanded.

          SOLUTION: ULTRIX: Upgrade/Install ULTRIX to V4.4 and install
                    the Security Enhanced Kit

                    DEC OSF/1: Upgrade/Install to a minimum of V1.2 and
                    install the Security Enhanced Kit or Upgrade to V3.0

    _____________________________________________________________________
    These kits are available from Digital Equipment Corporation by con-
    tacting your normal Digital support channel or by request via DSNlink
    for electronic transfer.

      *****************************************************************
      The kits are packaged for the affected versions by operating system
      type (ULTRIX and DEC OSF/1)
      *****************************************************************

    _____________________________________________________________________
    IMPACT:

    Digital has discovered the existence of potential security vulnerabi-
    lities in the ULTRIX V4.3, V4.3a, V4.4 and DEC OSF/1 V1.2, V1.3, V2.0
    Operating Systems, and DECnet-ULTRIX V4.2. These potential vulnerabi-
    lities were discovered as a result of evaluating recent reports of
    potential security vulnerabilities which were distributed on the
    INTERNET and as a result of Digitals continued engineering efforts.
    The solutions to these vulnerabilities have been included in the next
    release of ULTRIX and the current release DEC OSF/1 V3.0.

    The kits have been created to correct potential security vulnerabili-
    ties which, under certain circumstances may expand user access or
    privilege.

    Digital Equipment Corporation strongly urges Customers to upgrade to
    a minimum of ULTRIX V4.4 and DEC OSF/1 V2.0 then apply the Security
    Enhanced Kit.

      - Please refer to the applicable Release Note information prior to
        upgrading your installation.

        ***************************************************************
        These kits will not install on versions previous to ULTRIX V4.3
        or DEC OSF/1 V1.2.
        ***************************************************************

    _____________________________________________________________________
    KIT PART NUMBERS and DESCRIPTIONS

     AV-Q81EA-TE    ULTRIX V4.3 thru V4.4      CSCPAT_4060   V1.0
     AV-Q80VA-TE    DEC OSF/1 V1.2 thru V2.0   CSCPAT_4061   V1.0
          Including DECnet V4.2(only)

    _____________________________________________________________________
    The ULTRIX Security Enhanced kit replaces the following images:

    /usr/etc/comsat    ULTRIX V4.3, V4.3a, V4.4
    /usr/ucb/lpr    "                      "
    /usr/ucb/mail    "                      "
    /usr/lib/sendmail    "                      "

    /usr/etc/telnetd    ULTRIX V4.3, V4.3a only

    ______________________________________
    for ULTRIX - DECnet V4.2 installations

    /usr/etc/dlogind
    /usr/etc/telnetd.gw
    *sendmail - is a previously distributed solution.

    _____________________________________________________________________
    The DEC OSF/1 Security Enhanced kit replaces the following images:

    /usr/sbin/comsat                DEC OSF/1 V1.2, V1.3 V2.0
    /usr/bin/lpr      "                   "
    /usr/bin/rdist      "                   "

    /usr/sbin/sendmail    DEC OSF/1 V1.2, V1.3  only
    /usr/shlib/libsecurity.so  DEC OSF/1 V2.0 only
    *sendmail - is a previously distributed solution.
    _____________________________________________________________________
    Digital urges you to periodically review your system management and
    security procedures. Digital will continue to review and enhance the
    security features of its products and work with customers to maintain
    and improve the security and integrity of their systems.
    _____________________________________________________________________
    NOTE: For non-contract/non-warranty customers contact your local
          Digital support channels for information regarding these kits.

----------------------------------------------------------------------------
The SERT team wishes to thank Rich Boren of DEC's Software Security
Response Team (SSRT) and Andrew Rutherford of Adelaide University
for their advice and cooperation in this matter.
----------------------------------------------------------------------------

If you believe that your system has been compromised, contact SERT or your
representative in FIRST (Forum of Incident Response and Security Teams).

Internet Email:  sert@sert.edu.au
Facsimile:  (07) 365 4477
SERT Hotline:  (07) 365 4417
    SERT personnel answer during business hours (AEST - GMT+10:00).
    (On call after hours for emergencies).

Security Emergency Response Team
c/- Prentice Centre
The University of Queensland
Qld.  4072.
Australia.