-----BEGIN PGP SIGNED MESSAGE-----

- ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---

                  =======  ============    ======       ======
                  =======  ==============  =======     =======
                    ===      ===     ====    ======   ======
                    ===      ===========     ======= =======
                    ===      ===========     === ======= ===
                    ===      ===     ====    ===  =====  ===
                  =======  ==============  =====   ===   =====
                  =======  ============    =====    =    =====

                           EMERGENCY RESPONSE SERVICE
      OUTSIDE ADVISORY REDISTRIBUTION

05 August 1996 12:00 GMT                         Number: ERS-OAR-E01-1996:010.1
===============================================================================

The IBM-ERS Outside Advisory Redistribution is designed to provide customers
of the IBM Emergency Response Service with access to the security advisories
sent out by other computer security incident response teams, vendors, and
other groups concerned about security.

IBM makes no representations and assumes no responsibility for the contents or
accuracy of the advisories themselves.

IBM-ERS is forwarding the following information from AUSCERT.  Contact
information for AUSCERT is included in the forwarded text below; please
contact them if you have any questions or need further information.

===============================================================================

********************** FORWARDED INFORMATION STARTS HERE **********************

AL-96.03                    AUSCERT Alert
                  Vulnerability in Solaris 2.x admintool
                             30 July 1996
- -----------------------------------------------------------------------------

AUSCERT has received a report of a vulnerability in the Sun Microsystems
Solaris 2.x distribution involving the program admintool.  This program is
used to provide a graphical user interface to numerous system administration
tasks.

This vulnerability may allow a local user to gain root privileges.

Exploit details involving this vulnerability have been made publicly
available.

At this stage, AUSCERT is not aware of any official patches.  AUSCERT
recommends that sites take the actions suggested in Section 3 until official
patches are available.

- -----------------------------------------------------------------------------

1.  Description

    admintool is a graphical user interface that enables an administrator to
    perform several system administration tasks on a system.  These tasks
    include the ability to manage users, groups, hosts and other services.

    To help prevent different users updating system files simultaneously,
    admintool uses temporary files as a locking mechanism.  The handling of
    these temporary files is not performed in a secure manner, and hence it
    may be possible to manipulate admintool into creating or writing to
    arbitrary files on the system.  These files are accessed with the
    effective uid of the process executing admintool.

    In Solaris 2.5, admintool is set-user-id root by default.  That is, all
    file accesses are performed with the effective uid of root.  An effect
    of this is that the vulnerability will allow access to any file on the
    system.  If the vulnerability is exploited to try and create a file that
    already exists, the contents of that file will be deleted.  If the file
    does not exist, it will be created with root ownership and be world
    writable.

    In earlier versions of Solaris 2.x, admintool is not set-user-id root
    by default.  In this case, admintool runs only with the privileges of
    the user executing it.  However, local users may wait for a specific user
    to execute admintool, exploiting the vulnerability to create or write
    files with that specific users' privileges.  Again, files created in this
    manner will be world writable.

2.  Impact

    A local user may be able to create or write to arbitrary files on the
    system.  This can be leveraged to gain root privileges.

3.  Workarounds/Solution

    Currently, AUSCERT is not aware of any official patches which address
    this vulnerability.  When official patches are made available, AUSCERT
    suggests that they be installed.

    Until official patches are available sites are encouraged to 
    completely prevent execution of admintool by any user (including root).

  # chmod 400 /usr/bin/admintool
  # ls -l /usr/bin/admintool
  -r--------   1 root  sys  303516 Oct 27  1995 /usr/bin/admintool

    Note that if only the setuid permissions are removed, it is still possible
    for users to gain privileges when admintool is executed as root.

    AUSCERT recommends that, where possible, admintool should not be used at
    all until official patches are available.  In the interim, system
    administrators should perform administration tasks by using the command
    line equivalents.  More details on performing these tasks may be found
    in the Sun documentation set.

- -----------------------------------------------------------------------------
AUSCERT wishes to thank Brian Meilak (QUT), Marek Krawus (UQ), Leif
Hedstrom, Kim Holburn and Michael James for their assistance in this matter.
- -----------------------------------------------------------------------------

The AUSCERT team have made every effort to ensure that the information
contained in this document is accurate.  However, the decision to use the
information described is the responsibility of each user or organisation.
The appropriateness of this document for an organisation or individual system
should be considered before application in conjunction with local policies
and procedures.  AUSCERT takes no responsibility for the consequences of
applying the contents of this document.

If you believe that your system has been compromised, contact AUSCERT or your
representative in FIRST (Forum of Incident Response and Security Teams).

AUSCERT is located at The University of Queensland within the Prentice Centre.
AUSCERT is a full member of the Forum of Incident Response and Security Teams
(FIRST).

AUSCERT maintains an anonymous FTP service which is found on:
ftp://ftp.auscert.org.au/pub/.  This archive contains past SERT and AUSCERT
Advisories, and other computer security information.

AUSCERT also maintains a World Wide Web service which is found on:
http://www.auscert.org.au/.

Internet Email: auscert@auscert.org.au
Facsimile:  (07) 3365 4477
Telephone:  (07) 3365 4417 (International: +61 7 3365 4417)
    AUSCERT personnel answer during Queensland business hours
    which are GMT+10:00 (AEST).
    On call after hours for emergencies.

Postal:
Australian Computer Emergency Response Team
c/- Prentice Centre
The University of Queensland
Brisbane
Qld.  4072.
AUSTRALIA

*********************** FORWARDED INFORMATION ENDS HERE ***********************

===============================================================================

IBM's Internet Emergency Response Service (IBM-ERS) is a subscription-based
Internet security response service that includes computer security incident
response and management, regular electronic verification of your Internet
gateway(s), and security vulnerability alerts similar to this one that are
tailored to your specific computing environment.  By acting as an extension
of your own internal security staff, IBM-ERS's team of Internet security
experts helps you quickly detect and respond to attacks and exposures across
your Internet connection(s).

As a part of IBM's Business Recovery Services organization, the IBM Internet
Emergency Response Service is a component of IBM's SecureWay(tm) line of
security products and services.  From hardware to software to consulting,
SecureWay solutions can give you the assurance and expertise you need to
protect your valuable business resources.  To find out more about the IBM
Internet Emergency Response Service, send an electronic mail message to
ers-sales@vnet.ibm.com, or call 1-800-742-2493 (Prompt 4).

IBM-ERS maintains a site on the World Wide Web at http://www.ers.ibm.com/.
Visit the site for information about the service, copies of security alerts,
team contact information, and other items.

IBM-ERS uses Pretty Good Privacy* (PGP*) as the digital signature mechanism for
security vulnerability alerts and other distributed information.  The IBM-ERS
PGP* public key is available from http://www.ers.ibm.com/team-info/pgpkey.html.
"Pretty Good Privacy" and "PGP" are trademarks of Philip Zimmerman.

IBM-ERS is a Member Team of the Forum of Incident Response and Security Teams
(FIRST), a global organization established to foster cooperation and response
coordination among computer security teams worldwide.

The information in this document is provided as a service to customers of
the IBM Emergency Response Service.  Neither International Business Machines
Corporation, Integrated Systems Solutions Corporation, nor any of their
employees, makes any warranty, express or implied, or assumes any legal
liability or responsibility for the accuracy, completeness, or usefulness of
any information, apparatus, product, or process contained herein, or
represents that its use would not infringe any privately owned rights.
Reference herein to any specific commercial products, process, or service by
trade name, trademark, manufacturer, or otherwise, does not necessarily
constitute or imply its endorsement, recommendation or favoring by IBM or
its subsidiaries.  The views and opinions of authors expressed herein do not
necessarily state or reflect those of IBM or its subsidiaries, and may not be
used for advertising or product endorsement purposes.

- ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---

-----BEGIN PGP SIGNATURE-----
Version: 2.7.1

iQCVAwUBMgXrnfWDLGpfj4rlAQEG8AP/bSod3fVC42q55R2eLCM+W56f0KJkAiZx
3mx9Sa1KVd07nDl3VDvIumW//hUC0f0mr/TyW4YFZxF+F2Y8QzdGRsCFO+Eolqcg
szjcNuNy1+FEMc2rphpWWrFopcoEVv5q5sS4YFLu/CRdbzYw/gI6PlVZ9RXF8a4q
kIREZkffXd8=
=K1E5
-----END PGP SIGNATURE-----