**************************************************************************
Security Bulletin 9126 DISA Defense Communications System
19 December 1991 Published by: DDN Security Coordination Center
(
[email protected]) 1-(800) 365-3642
DEFENSE DATA NETWORK
SECURITY BULLETIN
The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security
Coordination Center) under DISA contract as a means of communicating
information on network and host security exposures, fixes, & concerns
to security & management personnel at DDN facilities. Back issues may
be obtained via FTP (or Kermit) from NIC.DDN.MIL [192.112.36.5]
using login="anonymous" and password="guest". The bulletin pathname is
SCC:DDN-SECURITY-yynn (where "yy" is the year the bulletin is issued
and "nn" is a bulletin number, e.g. SCC:DDN-SECURITY-9126).
**************************************************************************
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
! !
! The following important advisory was issued by the Computer !
! Emergency Response Team (CERT) and is being relayed unedited !
! via the Defense Information Systems Agency's Security !
! Coordination Center distribution system as a means of !
! providing DDN subscribers with useful security information. !
! !
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
===========================================================================
CA-91:22 CERT Advisory
December 16, 1991
SunOS OpenWindows V3.0 Patch
---------------------------------------------------------------------------
The Computer Emergency Response Team/Coordination Center (CERT/CC) has
received information concerning a vulnerability in Sun Microsystems,
Inc. (Sun) OpenWindows version 3.0. This vulnerability exists on all
sun4 and sun4c architectures running SunOS 4.1.1.
Sun has provided a patch for this vulnerability. It is available
through your local Sun Answer Center as well as through anonymous ftp
from the ftp.uu.net (192.48.96.2) system in the /sun-dist directory.
Fix PatchID Filename Checksum
loadmodule 1076118 100448-01.tar.Z 04354 5
Please note that Sun will occasionally update patch files. If you
find that the checksum is different please contact Sun or the CERT/CC
for verification.
---------------------------------------------------------------------------
I. Description
An OpenWindows, version 3, setuid program (loadmodule(8)) can be
exploited to execute a user's program using the effective UID of root.
II. Impact
This vulnerability allows a local user to gain root access.
III. Solution
Obtain the patch from Sun or from ftp.uu.net and install, following the
provided instructions.
As root:
1. Move the existing loadmodule aside.
# mv $OPENWINHOME/bin/loadmodule $OPENWINHOME/bin/loadmodule.orig
# chmod 400 $OPENWINHOME/bin/loadmodule.orig
2. Copy the new loadmodule into the OpenWindows bin directory.
# cp sun4/loadmodule $OPENWINHOME/bin/loadmodule
# chown root $OPENWINHOME/bin/loadmodule
# chmod 4755 $OPENWINHOME/bin/loadmodule
See the README file provided with the patch for more information.
---------------------------------------------------------------------------
The CERT/CC wishes to thank Ken Pon at Sun Microsystems, Inc. for alerting
us to this vulnerability.
---------------------------------------------------------------------------
If you believe that your system has been compromised, contact CERT/CC via
telephone or e-mail.
Internet E-mail:
[email protected]
Telephone: 412-268-7090 24-hour hotline:
CERT/CC personnel answer 7:30a.m.-6:00p.m. EST(GMT-5)/EDT(GMT-4),
on call for emergencies during other hours.
Computer Emergency Response Team/Coordination Center (CERT/CC)
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213-3890
Past advisories and other information related to computer security are
available for anonymous ftp from the cert.sei.cmu.edu (192.88.209.5)
system.
Downloaded From P-80 International Information Systems 304-744-2253
