**************************************************************************
Security Bulletin 9118 DISA Defense Communications System
1 October 1991 Published by: DDN Security Coordination Center
(
[email protected]) 1-(800) 365-3642
DEFENSE DATA NETWORK
SECURITY BULLETIN
The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security
Coordination Center) under DISA contract as a means of communicating
information on network and host security exposures, fixes, & concerns
to security & management personnel at DDN facilities. Back issues may
be obtained via FTP (or Kermit) from NIC.DDN.MIL [192.112.36.5]
using login="anonymous" and password="guest". The bulletin pathname is
SCC:DDN-SECURITY-yynn (where "yy" is the year the bulletin is issued
and "nn" is a bulletin number, e.g. SCC:DDN-SECURITY-9118).
**************************************************************************
Vulnerability of DECnet-Internet gateway software
in (DEC) ULTRIX versions 4.0, 4.1, and 4.2.
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
! !
! The following important advisory was issued by the Computer !
! Emergency Response Team (CERT) and is being relayed unedited !
! via the Defense Communications Agency's Security Coordination !
! Center distribution system as a means of providing DDN !
! subscribers with useful security information. !
! !
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
CA-91:17 CERT Advisory
September 26, 1991
DECnet-Internet Gateway Vulnerability
---------------------------------------------------------------------------
The Computer Emergency Response Team/Coordination Center (CERT/CC) has
received information concerning a vulnerability in the configuration of
the DECnet-Internet gateway software for Digital Equipment Corporation's
(DEC) ULTRIX versions 4.0, 4.1, and 4.2 on all Digital architectures.
Digital Equipment Corporation is aware of this problem and a resolution
for this vulnerability will be included in a future release. Digital
and the CERT/CC strongly recommend that sites exposed to this vulnerability
immediately institute the workaround detailed in this advisory.
---------------------------------------------------------------------------
I. Description
When installing the DECnet-Internet gateway software it is necessary to
create a guest account on the ULTRIX gateway host. By default, this
account has /bin/csh as its shell. By virtue of the guest account
having a valid shell, the DECnet-Internet gateway software can be
exploited to allow unauthorized root access.
II. Impact
Anyone using the DECnet-Internet gateway can gain unauthorized
root privileges on the ULTRIX gateway host.
III. Solution
This section describes a workaround for this vulnerability.
Disable the guest account by editing the /etc/passwd file and setting
the shell field for the guest account to /bin/false. Also, ensure the
guest account has the string "NoLogin" in the password field as detailed
in the DECnet-Internet installation manual.
Even if you have not installed or are not running the DECnet-
Internet gateway software, Digital recommends that you implement the
workaround solution stated above.
---------------------------------------------------------------------------
The CERT/CC wishes to thank R. Scott Butler of the Du Pont Company for
bringing this vulnerability to our attention and for his further
assistance with the temporary workaround.
---------------------------------------------------------------------------
If you believe that your system has been compromised, contact CERT/CC via
telephone or e-mail.
Computer Emergency Response Team/Coordination Center (CERT/CC)
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213-3890
Internet E-mail:
[email protected]
Telephone: 412-268-7090 24-hour hotline:
CERT/CC personnel answer 7:30a.m.-6:00p.m. EST/EDT,
on call for emergencies during other hours.
Past advisories and other computer security related information are available
for anonymous ftp from the cert.sei.cmu.edu (192.88.209.5) system.
Downloaded From P-80 International Information Systems 304-744-2253
