-----BEGIN PGP SIGNED MESSAGE-----

             __________________________________________________________

                       The U.S. Department of Energy
                    Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

            SunOS 4.1.X Loadmodule Vulnerability

November 3, 1995 01:00 GMT                                          Number G-02
_______________________________________________________________________________


PROBLEM:        A bug exists in the loadmodule(8) program which, when exploited,
                can allow a user to gain root access.
PLATFORM:  SunOS 4.1.x
DAMAGE:         This problem makes it possible for a local user to obtain root
                access.
SOLUTION:       Apply either the fix or the patch described below.
- -------------------------------------------------------------------------------
VULNERABILITY   An exploitation script has been found to be publicly available.
ASSESSMENT:     
- -------------------------------------------------------------------------------

Introduction

    The loadmodule(8) program is used by the xnews(1) window system to
    dynamically load kernel driver modules. Two of these module provide a SunView
    binary compatibility mode. However, these modules introduce a vulnerability
    which makes it possible for a normal user to gain unauthorized access.

Solutions

     A. Obtain and install the appropriate patches according to the
        instructions included with the patches. Patches are available through
        your local Sun Answer Center and by FTP from

             ftp://sunsolve1.sun.com/pub/patches/100448-03.tar.Z 

        Module           Patch ID        Filename
        ----------       ---------       ---------------
        loadmodule       100448-03       100448-03.tar.Z

        Checksum:
            MD5 (100448-03.tar.Z) = 183a22f0a2f6020f1389b6aeea5ca6c6

     B. Because, in general, a set-user-id program can lead to security
        exposures, you should also do at least step 1 below. We recommend
        doing steps 2 and 3 as well.

        The intent of these directions is make the loadmodule(8) program
        work only for the super-user (currently it works for all users because
        it is set-user-id) and to execute it each time the system boots. By
        following these directions, users who require SunView binary
        compatibility will have it available to them.  

        1. If you do not need SunView binary compatibility, then as root,
           turn off setuid root on the loadmodule(8) program with

                # /bin/chmod u-s /usr/openwin/bin/loadmodule

        2. If your users need SunView binary compatibility, you can
           enable it immediately--that is without having to reboot
           your system--with the following script.

        ------------------------cut here--8<------------------------
        ARCH=`/bin/arch -k`
        OBJ=/sys/${ARCH}/OBJ
        LM=/usr/openwin/bin/loadmodule
        /bin/chmod u-s $LM
        if [ -f $OBJ/evqmod-${ARCH}.o ]; then
          if /usr/etc/modstat | /bin/egrep -s evqmod ; then
            echo evq: already loaded
          elif $LM evqmod-${ARCH}.o evqload; then
            echo evq: loaded
          else
            echo evq: unable to load module
          fi
        fi
        if [ -f $OBJ/winlock-${ARCH}.o ]; then
          if /usr/etc/modstat | /bin/egrep -s winlock ; then
            echo winlock: already loaded
          elif $LM winlock-${ARCH}.o winlockload; then
            echo winlock: loaded
          else
            echo winlock: unable to load module
          fi
        fi
        ------------------------cut here--8<------------------------

        As a suggestion, store this script in /tmp/esbc and then
        execute it as root with:

                # sh /tmp/esbc

     3. If you've done step 2 above, the module loadings will disappear
        the next time you reboot your system. To make them permanent--
        that is to make these module loadings occur each time your system
        is rebooted--add the script to the end of your /etc/rc.local file.
        


_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of the CERT Coordination
Center for information contained in this bulletin.
_______________________________________________________________________________


CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of
Energy. CIAC is located at the Lawrence Livermore National Laboratory
in Livermore, California. CIAC is also a founding member of FIRST, the
Forum of Incident Response and Security Teams, a global organization
established to foster cooperation and coordination among computer
security teams worldwide.

CIAC services are available to DOE and DOE contractors, and CIAC can be 
contacted at:
    Voice:    +1 510-422-8193
    FAX:      +1 510-423-8002
    STU-III:  +1 510-423-2604
    E-mail:   ciac@llnl.gov

For emergencies and off-hour assistance, DOE and DOE contractor sites may 
contact CIAC 24-hours a day. During off hours (5PM - 8AM PST), call the CIAC 
voice number 510-422-8193 and leave a message, or call 800-759-7243 
(800-SKY-PAGE) to send a Sky Page. CIAC has two Sky Page PIN numbers, the 
primary PIN number, 8550070, is for the CIAC duty person, and the secondary 
PIN number, 8550074 is for the CIAC Project Leader.

Previous CIAC notices, anti-virus software, and other information are 
available from the CIAC Computer Security Archive. 

   World Wide Web:  http://ciac.llnl.gov/
   Anonymous FTP:   ciac.llnl.gov (128.115.19.53)
   Modem access:    +1 (510) 423-4753 (14.4K baud)
                    +1 (510) 423-3331 (9600 baud)

CIAC has several self-subscribing mailing lists for electronic publications:
1. CIAC-BULLETIN for Advisories, highest priority - time critical information 
   and Bulletins, important computer security information;
2. CIAC-NOTES for Notes, a collection of computer security articles;
3. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI) 
   software updates, new features, distribution and availability;
4. SPI-NOTES, for discussion of problems and solutions regarding the use of 
   SPI products.

Our mailing lists are managed by a public domain software package called 
ListProcessor, which ignores E-mail header subject lines. To subscribe (add 
yourself) to one of our mailing lists, send the following request as the 
E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES, SPI-ANNOUNCE or 
SPI-NOTES for list-name and valid information for LastName FirstName and 
PhoneNumber when sending

E-mail to  ciac-listproc@llnl.gov:
  subscribe list-name LastName, FirstName PhoneNumber
  e.g.,  subscribe ciac-notes OUHara, Scarlett W. 404-555-1212 x36

You will receive an acknowledgment containing address, initial PIN, and 
information on how to change either of them, cancel your subscription, or 
get help. 

PLEASE NOTE: Many users outside of the DOE and ESnet computing communities
receive CIAC bulletins.  If you are not part of these communities, please
contact your agency's response team to report incidents. Your agency's team
will coordinate with CIAC. The Forum of Incident Response and Security Teams
(FIRST) is a world-wide organization. A list of FIRST member organizations and
their constituencies can be obtained by sending email to docserver@first.org
with an empty subject line and a message body containing the line: send
first-contacts.

This document was prepared as an account of work sponsored by an agency of the
United States Government. Neither the United States Government nor the
University of California nor any of their employees, makes any warranty,
express or implied, or assumes any legal liability or responsibility for the
accuracy, completeness, or usefulness of any information, apparatus, product,
or process disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products, process,
or service by trade name, trademark, manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation or favoring by
the United States Government or the University of California. The views and
opinions of authors expressed herein do not necessarily state or reflect those
of the United States Government or the University of California, and shall not
be used for advertising or product endorsement purposes.


LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

(F-21)  Protecting SUN OS Systems Against SATAN
(F-22)  SATAN Password Disclosure
(F-23)  Protecting IBM AIX Systems Against SATAN
(F-24)  Protecting SGI IRIX Systems Against SATAN
(F-25)  Cisco IOS Router Software Vulnerability
(F-26)  OSF/DCE Security Hole
(F-27)  Incorrect Permissions on /tmp
(F-28)  Vulnerability in SunOS 4.1.* Sendmail (-oR option)
(F-28)  Vulnerability in SunOS 4.1.* Sendmail (-oR option)
(G-1)   Telnetd Vulnerability


RECENT CIAC NOTES ISSUED IN FY1995 (Previous Notes available from CIAC)

Notes 07 - 3/29/95
A comprehensive review of SATAN

Notes 08 - 4/4/95
A Courtney update

Notes 09 - 4/24/95
More on the "Good Times" virus urban legend

Notes 10 - 6/16/95
Discusses the PKZ300B Trojan, Logdaemon/FreeBSD vulnerability
in S/Key, EBOLA Virus Hoax, and Caibua Virus

Notes 11 - 7/31/95
Features include a Virus Update, Hats Off to Administrators,
America On-Line Virus Scare, SPI 3.2.2 Released, The Die_Hard Virus

Notes 12 - 9/12/95
Features include discussions on securely configuring Public
Telnet Services, X Windows and announces the beta release of Merlin,
describes the Microsoft Word Macro Viruses, and examines allegations
of Inappropriate Data Collection in Win95

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface

iQCVAwUBMJmAtrnzJzdsy3QZAQEFFgP/VdkJBIzW1kiHdQDaO+mLYuFQ275M+eWM
FVn3rC+xPYvB79+P6CTmGIzq/h4MuREWK3UztyvcfvdMYfjZEL8bHqAvFeVl7qPK
cqOercQ7PWpplTqdjUiC9jhM5+sETq6KqLP0/GnXCAxupAv5/NewF/njssreq4yJ
zIGWbJIDQ6M=
=xRwS
-----END PGP SIGNATURE-----