******************************************************************************
             ------               -----   -----  ---     -----
             |      ----- ----   |          |    |  |   |
             |---   |     |   |  |          |    |  |   |
             |      |--   |   |  |          |    |--    |
             |      |     |   |  |          |    | \    |
             |      ----- ----    -----   -----  |  \    -----

                               A D V I S O R Y

                                  97.71
******************************************************************************
Topic: Vulnerability in "nosuid" mount option
Source: CERT/CC

Creation Date: October 14, 1997
Last Updated:


To aid in the wide distribution of essential security information, FedCIRC is
forwarding the following information from <CERT/CC vendor-initiated bulletin
VB-97.11. FedCIRC urges you to act on this information as soon as possible.

If you have any questions, please contact FedCIRC:

        Telephone:      +1 888 282 0870
        Email:          fedcirc@fedcirc.gov



=======================FORWARDED TEXT STARTS HERE============================
-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
CERT* Vendor-Initiated Bulletin VB-97.11
October 14, 1997

Topic: Vulnerability in "nosuid" mount option.  
Source: NEC Corporation 

To aid in the wide distribution of essential security information, the CERT
Coordination Center is forwarding the following information from NEC
Corporation. NEC urges you to act on this information as soon as possible. NEC
contact information is included in the forwarded text below; please contact
them if you have any questions or need further information.


=======================FORWARDED TEXT STARTS HERE============================
______________________________________________________________________________
                        NEC Corporation Security Bulletin

Title:          Vulnerability in "nosuid" mount option
Affects:        EWS-UX/V(Rel4.2) R7.x - R10.x
                EWS-UX/V(Rel4.2MP) R10.x
                UP-UX/V(Rel4.2MP) R5.x - R7.x
                UX/4800 R11.x - 12.1
Document ID:    SB-19971010-01
Date Issued:    October 10, 1997
______________________________________________________________________________

1. Description

    NEC Corporation has identified and corrected a problem with the
    "nosuid" mount(1) option.  The "nosuid" mount(1) option nullifies
    the effect of setuid and setgid bits for files on a particular file
    system.  This problem manifests itself by allowing setuid and setgid
    program execution on file systems mounted with "nosuid".

    The following NEC/UNIX platforms are affected:

        EWS-UX/V(Rel4.2) R7.x - R10.x
        EWS-UX/V(Rel4.2MP) R10.x
        UP-UX/V(Rel4.2MP) R5.x - R7.x
        UX/4800 R11.x - 12.1

    NEC strongly recommends that administrators of affected systems
    follow the instructions in section 3 of this bulletin.

2. Impact

    By exploiting this vulnerability, local users can invoke commands 
    as other users and possibly achieve root privileges to execute
    arbitrary commands.

3. Workarounds/Solution

    The patches listed below change the way execution privileges are
    calculated so that setuid and setgid bits are correctly ignored on
    file systems mounted with the "nosuid" option.

    Patches for platforms not listed in Section 3.2 are still in progress.
    For these systems, we recommend either unmounting file systems mounted
    "nosuid" or applying the workaround as described in Section 3.1 until
    patches are made available.

3.1. Remove setuid/setgid permission (workaround)

    To prevent possible exploitation of this vulnerability, until a patch
    is made available for your platform, we recommend the following steps:

    1) Make a local copy of each remote file system mounted with the
       "nosuid" option.

        # find <mountpoint> -depth -print | cpio -pdm <localcopy>

    2) Unmount the remote file system and replace it with the local copy.

        # umount <mountpoint>
        # mount <localdev> <mountpoint>

    3) Run the find(1) command below to remove all setuid and setgid bits
       on files in the local copy of the remote hierarchy.

        # find <mountpoint> -print -exec chmod ug-s {} \;

3.2. Install a patch

    This vulnerability is corrected by the following patches:

        OS version                      Patch ID
        ----------                      --------
        EWS-UX/V(Rel4.2) R7.x           NECe70093
        EWS-UX/V(Rel4.2) R8.x           NECe80121
        EWS-UX/V(Rel4.2) R9.x           NECe90281, NECe90282(for 110N)
        EWS-UX/V(Rel4.2) R10.x          NECea0168
        EWS-UX/V(Rel4.2MP) R10.x        NECma0378
        UP-UX/V(Rel4.2MP) R5.x          NECu50078
        UP-UX/V(Rel4.2MP) R6.x          NECu60217
        UP-UX/V(Rel4.2MP) R7.x          NECu70541
        UX/4800 R11.x                   NECmb0668
        UX/4800 R12.x                   NECmc0054

    See section 4 of this bulletin for checksum information.

    These patches are available from:
        ftp://ftp.meshnet.or.jp/pub/48pub/security

    For a directory tree map, consult the README file.

    For further information, please contact by e-mail:
        UX48-security-support@nec.co.jp

4. Checksum and additional information for patches.

    Patch ID: NECe70093

        Patch          : NECe70093.210.pkg.Z
        Target Hardware: 210,120LT,215,130LT,210II
        sum            : 17018 22
        md5            : 56CE37185FD7D5BCB6D28F6BD8DEFFBB

        Patch          : NECe70093.220.pkg.Z
        Target Hardware: 220,260,230
        sum            : 16078 22
        md5            : 251A0B2239B415A6F9324F68C99F8B14

        Patch          : NECe70093.330.pkg.Z
        Target Hardware: 330,110LT,310,320,360
        sum            : 18075 22
        md5            : 54A7DA54894E470CC8F4C879E6283AD0

        Patch          : NECe70093.350.pkg.Z
        Target Hardware: 350,350F,380
        sum            : 892 21
        md5            : BCBB5A319A0AB471ECB8EE5F154ECDCE

    Patch ID: NECe80121

        Patch          : NECe80121.210.pkg.Z
        Target Hardware: 210,120LT,215,130LT,210II
        sum            : 35542 21
        md5            : 6D33DCE306B41996CB671EB9DB3DADD3

        Patch          : NECe80121.220.pkg.Z
        Target Hardware: 220,260,230
        sum            : 19176 21
        md5            : 32F955A3DEA4B76D552ACE5C3125AA9B

        Patch          : NECe80121.330.pkg.Z
        Target Hardware: 330,110LT,310,320,360
                         140LT,150LT,360AD,360A,OM
        sum            : 6993 21
        md5            : 9425197116B75C919B10DF0F2A948A78

        Patch          : NECe80121.350.pkg.Z
        Target Hardware: 350,350F,380
        sum            : 4723 21
        md5            : 5A86DA101711317C1DA87541155229CC

    Patch ID: NECe90281

        Patch          : NECe90281.210.pkg.Z
        Target Hardware: 210,120LT,215,130LT,210II
        sum            : 1426 20
        md5            : 1BE96184A9C6645899DD6CFFC1C5E00D

        Patch          : NECe90281.220.pkg.Z
        Target Hardware: 220,260,230
        sum            : 4671 20
        md5            : CA002CF9C4B86880D044F320B80D9800

        Patch          : NECe90281.330.pkg.Z
        Target Hardware: 330,110LT,310,320,360
                         140LT,150LT,360AD,360A,OM
                         310LC,320EX,320SX,330EX,330AD
                         360EX,360ADII
        sum            : 49879 20
        md5            : 2045FF5FC608600DBE87D8C2AF08F7AA

        Patch          : NECe90281.350.pkg.Z
        Target Hardware: 350,350F,380
        sum            : 53666 20
        md5            : D0722E3257CEADFA8E3B60D68EAA9C8C

    Patch ID: NECe90282

        Patch          : NECe90282.110N.pkg.Z
        Target Hardware: 110N
        sum            : 49054 20
        md5            : A244594291D8A8E398105EF1786B5A2A

    Patch ID: NECma0378

        Patch          : NECma0378.330.pkg.Z
        Target Hardware: 330,110LT,310,320,360
                         140LT,150LT,360AD,360A,OM
                         310LC,320EX,320SX,330EX,330AD
                         360EX,360ADII,320VX,360SX
        sum            : 62412 25
        md5            : 0ABDB0D337474622A178B5A90010DF1F

        Patch          : NECma0378.360MP.pkg.Z
        Target Hardware: 360MP
        sum            : 23244 25
        md5            : 682AA6A8BC97E91DBC14253F8E9C6FFC

    Patch ID: NECea0168
        Patch          : NECea0168.110N.pkg.Z
        Target Hardware: 110N,310EC
        sum            : 13328 21
        md5            : 21D6648E69158622AECAD8A1F1538511

    Patch ID: NECmb0668

        Patch          : NECmb0668.110N.pkg.Z
        Target Hardware: 110N,310EC,310LX,310ECII,110NII
        sum            : 61039 24
        md5            : 066DBA2EBAAB87B10D3C55C4161232F1

        Patch          : NECmb0668.210.pkg.Z
        Target Hardware: 210,120LT,215,130LT,210II
        sum            : 43893 24
        md5            : D6A0A08C2008F11BF1D11D670910893F

        Patch          : NECmb0668.220.pkg.Z
        Target Hardware: 220,260,230
        sum            : 47818 24
        md5            : A93FA1EE90055120892BF96FED4071C9

        Patch          : NECmb0668.330.pkg.Z
        Target Hardware: 330,110LT,310,320,360
                         140LT,150LT,360AD,360A,OM
                         310LC,320EX,320SX,330EX,330AD
                         360EX,360ADII,320VX,360SX
        sum            : 63097 24
        md5            : FBEEC273976D44E8593791CBC3006E94

        Patch          : NECmb0668.350.pkg.Z
        Target Hardware: 350,350F,380
        sum            : 46118 24
        md5            : 14AFB2F7CBE0FECE66C43E15D53A6959

        Patch          : NECmb0668.360MP.pkg.Z
        Target Hardware: 360MP
        sum            : 34423 24
        md5            : 04FFC169C0056C2E0E991C5593EC13EB

        Patch          : NECmb0668.FM.pkg.Z
        Target Hardware: 760,660R
        sum            : 34722 24
        md5            : 0E875E8E6677223C19EF92FFD8AAA17B

        Patch          : NECmb0668.ML.pkg.Z
        Target Hardware: 610
        sum            : 31695 24
        md5            : 43F48AE10F46DD5675F54C4171979B93

        Patch          : NECmb0668.RH.pkg.Z
        Target Hardware: 660,680,690,670,675
                         675AD
        sum            : 42993 24
        md5            : 84FCEF5034A0E5A430367A6F4F813839

        Patch          : NECmb0668.RH0.pkg.Z
        Target Hardware: 640,650
        sum            : 26945 24
        md5            : 5CC49D44154183D39DD18C51BA6D8BD9

        Patch          : NECmb0668.RL.pkg.Z
        Target Hardware: 605,615,615AD,615A
        sum            : 2916 24
        md5            : 0C88DA08FF160A1B132538E8A46E9E4B

        Patch          : NECmb0668.RM.pkg.Z
        Target Hardware: 625,635,635AD
        sum            : 63205 24
        md5            : 47D10396FC39C0FB7FE617D0B180DF08

        Patch          : NECmb0668.TH2.pkg.Z
        Target Hardware: 310PX,320PX,330PX
        sum            : 56681 24
        md5            : 12BC633B68667D8EC08E56B95CD1EC5B

        Patch          : NECmb0668.UD2.pkg.Z
        Target Hardware: 360PX,360PXII
        sum            : 26095 24
        md5            : 53251D6148665B16ADF3DF224485BA96

    Patch ID: NECmc0054

        Patch          : NECmc0054.110N.pkg.Z
        Target Hardware: 110N,310EC,310LX,310ECII,110NII
        sum            : 38080 23
        md5            : B27726AA05A082079E951F00222D6E7D

        Patch          : NECmc0054.210.pkg.Z
        Target Hardware: 210,120LT,215,130LT,210II
        sum            : 39082 23
        md5            : 590586BE5E847BD34780D2A68A908495

        Patch          : NECmc0054.220.pkg.Z
        Target Hardware: 220,260,230
        sum            : 37616 23
        md5            : CA9AD4DB7476E6753C7E06F5835AC61B

        Patch          : NECmc0054.330.pkg.Z
        Target Hardware: 330,110LT,310,320,360
                         140LT,150LT,360AD,360A,OM
                         310LC,320EX,320SX,330EX,330AD
                         360EX,360ADII,320VX,360SX
        sum            : 42500 23
        md5            : 31F228CA399A16DCEC4C7641D63D2E54

        Patch          : NECmc0054.350.pkg.Z
        Target Hardware: 350,350F,380
        sum            : 47172 23
        md5            : 711FBF6BD131FFA6FB1AC2E82BDB863D

        Patch          : NECmc0054.360MP.pkg.Z
        Target Hardware: 360MP
        sum            : 32933 23
        md5            : 20C52796D74B8FE1CD7FEC7CEA116708

        Patch          : NECmc0054.EH3.pkg.Z
        Target Hardware: 410,420
        sum            : 33478 23
        md5            : 5DE177B5E0BA6517192A6CB6DB53E4E8

        Patch          : NECmc0054.EL.pkg.Z
        Target Hardware: 710
        sum            : 2088 23
        md5            : 35908F4C918DA2D164D8C9B27A71061A

        Patch          : NECmc0054.FL.pkg.Z
        Target Hardware: 740
        sum            : 31787 23
        md5            : A4DD978D309F37DA72151247770ECC0D

        Patch          : NECmc0054.FM.pkg.Z
        Target Hardware: 760,660R,760R
        sum            : 31135 23
        md5            : F5FC7DBA2CFAD595FE72B520268BA02B

        Patch          : NECmc0054.ML.pkg.Z
        Target Hardware: 610
        sum            : 18801 23
        md5            : AD5954BF0E57B1593B12BAEB5A0C7151

        Patch          : NECmc0054.RH.pkg.Z
        Target Hardware: 660,680,690,670,675
                         675AD,770
        sum            : 18516 23
        md5            : A84E91CE094441E55BC967F0A33129E5

        Patch          : NECmc0054.RH0.pkg.Z
        Target Hardware: 640,650
        sum            : 27899 23
        md5            : 5B47CABA685D0C428869CC300BB1E8DE

        Patch          : NECmc0054.RL.pkg.Z
        Target Hardware: 605,615,615AD,615A
        sum            : 48090 23
        md5            : 5AD2B54F85BF83EE934D10BA8ABA3637

        Patch          : NECmc0054.RM.pkg.Z
        Target Hardware: 625,635,635AD
        sum            : 49278 23
        md5            : 3EEEAB2D6B42B8EF58291F07F7986E0E

        Patch          : NECmc0054.TH2.pkg.Z
        Target Hardware: 310PX,320PX,330PX
        sum            : 36503 23
        md5            : 7F937DFCAC8A09E39CDFA3DB757C7529

        Patch          : NECmc0054.UD2.pkg.Z
        Target Hardware: 360PX,360PXII
        sum            : 34087 23
        md5            : 7BD3E3E1C0C44AC0FF96071F0D7E3B04

        Patch          : NECmc0054.UD3.pkg.Z
        Target Hardware: 460
        sum            : 21713 23
        md5            : 02850DACF247867594A999A9CF32E5C3

    Patch ID: NECu50078
        
        Patch          : NECu50078.RH.pkg.Z
        Target Hardware: 660,680
        sum            : 24590 23
        md5            : A0CB7CE51889544BA00BA8600CA64068

    Patch ID: NECu60217

        Patch          : NECu60217.RH.pkg.Z
        Target Hardware: 660,680,690
        sum            : 12320 23
        md5            : B2853692FDB387C7A132BF5AE5047B33

        Patch          : NECu60217.RH0.pkg.Z
        Target Hardware: 640,650
        sum            : 18714 23
        md5            : EB2AD3AD7F0AC59E0750491D19446115

        Patch          : NECu60217.RL.pkg.Z
        Target Hardware: 605,615,615AD,615A
        sum            : 40312 24
        md5            : 3EFBE0C6873017ABFA7D2632BB7F686D

        Patch          : NECu60217.RM.pkg.Z
        Target Hardware: 625,635,635AD
        sum            : 21912 24
        md5            : 6B5B2936D081D849DEBC649595F917DD

    Patch ID: NECu70541

        Patch          : NECu70541.ML.pkg.Z
        Target Hardware: 610
        sum            : 43559 25
        md5            : E009D5CC456DDB3E5347038A584C724C

        Patch          : NECu70541.RH.pkg.Z
        Target Hardware: 660,680,690
        sum            : 47473 25
        md5            : 26A98C96AF71341961CC57CC5E55EB27

        Patch          : NECu70541.RH0.pkg.Z
        Target Hardware: 640,650
        sum            : 36458 25
        md5            : EAD7B3F4A48E97E4BCBAE83B298EE265

        Patch          : NECu70541.RL.pkg.Z
        Target Hardware: 605,615,615AD,615A
        sum            : 56520 25
        md5            : 593BD721536ABC1BC0694D757DD4387B

        Patch          : NECu70541.RM.pkg.Z
        Target Hardware: 625,635,635AD
        sum            : 5840 25
        md5            : 5D9AA821BE9D01AF39512E448E3F520E

============================================================================

========================FORWARDED TEXT ENDS HERE=============================

If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (FIRST). See http://www.first.org/team-info/.  

We strongly urge you to encrypt any sensitive information you send by email.
The CERT Coordination Center can support a shared DES key and PGP. Contact 
the CERT staff for more information.

Location of CERT PGP key
         ftp://ftp.cert.org/pub/CERT_PGP.key


CERT Contact Information
- ------------------------
Email    cert@cert.org

Phone    +1 412-268-7090 (24-hour hotline)
                CERT personnel answer 8:30-5:00 p.m. EST
                (GMT-5)/EDT(GMT-4), and are on call for
                emergencies during other hours.

Fax      +1 412-268-6989

Postal address
        CERT Coordination Center
        Software Engineering Institute
        Carnegie Mellon University
        Pittsburgh PA 15213-3890
        USA

CERT publications, information about FIRST representatives, and other
security-related information are available from
        http://www.cert.org/
        ftp://ftp.cert.org/pub/

CERT advisories and bulletins are also posted on the USENET newsgroup
        comp.security.announce

To be added to our mailing list for CERT advisories and bulletins, send your
email address to
        cert-advisory-request@cert.org
In the subject line, type 
        SUBSCRIBE  your-email-address 



* Registered U.S. Patent and Trademark Office.

The CERT Coordination Center is part of the Software Engineering
Institute (SEI). The SEI is sponsored by the U. S. Department of Defense.


This file: ftp://ftp.cert.org/pub/cert_bulletins/VB-97.11.nec



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNEKGrnVP+x0t4w7BAQEP4QQA2if0MNau8AvBwPPvy3lXnktztA2SNPSe
cDfu+Gb+xa1Wu79H4oX46G5UejW89nhoVVHPymMnulxQWpfCYmC/3f0PCCv5F5NY
RSStHuubAtvNEED19JsNKlw2vx5nbKHnVHdRF2/w9FsvML7dtCPwNDfLZ8CI/D5M
hViGxfndygw=
=Hv66
-----END PGP SIGNATURE-----


========================FORWARDED TEXT ENDS HERE=============================

The National Institute of Standards and Technology (NIST) has
established a Federal Computer Incident response Capability (FedCIRC)
to assist federal civilians agencies in their incident handling
efforts by providing proactive and reactive computer security related
services.  FedCIRC is a partnership among NIST, the Computer Incident
Advisory Capability (CIAC), and the CERT* Coordination Center
(CERT/CC). 

If you believe that your system has been compromised, please contact
FedCIRC: 

        Telephone:      +1 888 282 0870
        Email:          fedcirc@fedcirc.gov
        Web Server:     http://www.fedcirc.gov/

* Registered in U.S. Patent and Trademark Office
 
The CERT Coordination Center is part of the Software Engineering
Institute.  The Software Engineering Institute is sponsored by the
U.S. Department of Defense.

CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
 
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.