Date: 12/14/97 10:14:35 PM
From: X-Force <xforce@iss.net>
Subject: BoS: ISS Security Alert Summary v1 n8
To: ("<best-of-security@cyber.com.au>"@LOCAL)
CC: ("X-Force <xforce@arden.iss.net>"@LOCAL)
-----BEGIN PGP SIGNED MESSAGE-----
ISS Security Alert Summary
December 3, 1997
Volume 1 Number 8
X-Force Vulnerability and Threat Database: http://www.iss.net/xforce
To receive these Alert Summaries, subscribe to the ISS Alert mailing list
by sending an email to majordomo@iss.net and within the body of the
message type: 'subscribe alert'.
___
Index
4 Reported New Vulnerabilities
- SCO-scoterm
- land-dos
- SGI-syserr
- SGI-permtool
4 Updates
- Cisco-passwdloss
- HP-ppl
- SGI-at
- SGI-libXt
Risk Factor Key
___
Date Reported: 11/20/97
Vulnerability: SCO-scoterm
Affected Platforms: SCO Open Desktop/Open Server 3.0
SCO OpenServer 5.0
Risk Factor: High
Santa Cruz Operation Open Server's xterm, scoterm, has a vulnerability
that, if exploited, would allow any local user to execute arbitrary
commands with root privileges. SCO provides a workaround as well as a
patch for this problem.
References:
ftp://ftp.sco.COM/SSE/security_bulletins/SB.97:02a
http://ciac.llnl.gov/ciac/bulletins/i-016.shtml
___
Date Reported: 11/19/97
Vulnerability: land-dos
Affected Platforms: (From BUGTRAQ@NETSPACE.ORG 11/24, second hand
information not meant to be
comprehensive/accurate, contact vendor for exact
operating systems and versions)
AIX (3)
AmigaOS AmiTCP (4.2 (Kickstart 3.0))
BeOS Preview (Release 2 PowerMac)
BSDI (2.0, 2.1 (vanilla))
Cisco IOS/700
Cisco Catalyst 5xxx and 29xx switches
Digital VMS
FreeBSD (2.2.5-Release, 2.2.5-Stable, 3.0-Current)
HP External JetDirect Print Servers
IBM AS/400 OS7400 (3.7)
IRIX (5.2, 5.3)
MacOS MacTCP
MacOS (7.6.1 (OpenTransport 1.1.2), 8.0)
NetApp NFS server (4.1d, 4.3)
NetBSD (1.1, 1.2, 1.2a, 1.2.1, 1.3_ALPHA)
NeXTSTEP (3.0, 3.1)
OpenVMS (7.1 with UCX 4.1-7)
QNX (4.24)
Rhapsody Developer Release
SCO OpenServer (5.0.2 SMP, 5.0.4)
SCO Unixware (2.1.1, 2.1.2)
SunOS (4.1.3, 4.1.4)
Windows 95 (vanilla)
Windows 95 (with Winsock 2 and VIPUPD.EXE)
Windows NT (with SP3, with SP3 and simptcp-fix)
Risk Factor: High
A new bug called the land attack named by its discoverer, has been posted
to a security mailing list, BUGTRAQ, with an exploit that can lock up or
"freeze" many different operating systems as well as network hardware.
An attacker can send a SYN packet, which is normally used to open a
connection, to the host they want to attack. The packet is spoofed to
appear to the machine that it is coming from itself, from the same port.
When the machine tries to respond to itself multiple times, it crashes.
Many different operating systems and hardware such as routers, and hubs
have been reported to being vulnerable to this bug.
Packet filters that protect against IP address spoofing will be
effective in preventing Internet-launched land attacks. Cisco has released
information on how to configure their hardware to avoid this problem.
References:
http://www.iss.net/xforce/advisories/land1.asc (original BUGTRAQ post)
http://www.iss.net/xforce/advisories/land2.asc (affected platforms)
http://www.cisco.com/warp/public/770/land-pub.shtml
ftp://ietf.org/internet-drafts/draft-ferguson-ingress-filtering-03.txt
___
Date Reported: 11/18/97
Vulnerability: SGI-syserr
Affected Platforms: All SGI systems running Desktop System Monitor
Risk Factor: High
IRIX's syserr is the System Error Notification Broker program and is part
of the Desktop System Monitor. It monitors system events and notifies the
user when the events occur. A vulnerability exists in syserr that allows
local accounts to create and corrupt random files.
Reference:
ftp://sgigate.sgi.com/security/19971103-01-PX
___
Date Reported: 11/18/97
Vulnerability: SGI-permtool
Affected Platforms: All SGI systems running Indigo Magic Desktop
Risk Factor: High
Indigo Magic Desktop contains a program called permissions tool. It is
used to modify the permission bits (owner, group, and others) for files
and directories (similar to chmod). It contains a vulnerability that
allows local accounts to gain access to a privileged user.
Reference:
ftp://sgigate.sgi.com/security/19971103-01-PX
___
Date: 11/25/97 (ISS Security Alert Summary v1 n7)
Update: Cisco-passwdloss
Vendor: Cisco
Platforms: LocalDirector 1.6.3
Cisco has investigated the password loss problem in LocalDirector 1.6.3
and was unable to reproduce it. They believe that the reports were caused
by an error on the user's end. Cisco is currently fixing the user
interface to make it more difficult for the user to lose their password
without knowing it. Cisco is still trying to reproduce this to make sure
their assessment is correct.
Reference:
http://www.cisco.com/warp/public/770/ldpass-pub.shtml
___
Date: 11/24/97 (HP Security Bulletin #00057 4/22/97)
Update: HP-ppl
Vendor: Hewlett Packard
Platforms: HP-UX (9.x, 10.x)
Hewlett Packard has released new patches for the ppl vulnerability that
was disclosed in April (HP has *revised* HP Security Bulletin #00057).
References:
http://us-support.external.hp.com - HP Security Bulletin #00057
http://ciac.llnl.gov/ciac/bulletins/i-31a.shtml
___
Date: 11/18/97 (CERT Advisory CA-97.18 6/12/97)
Update: SGI-at
Vendor: Silicon Graphics Inc.
Platforms: IRIX (3.x, 4.x, 5.0.x, 5.1.x, 5.2, 5.3
6.0.x, 6.1, 6.2, 6.3, 6.4)
The at program can be used by local users to schedule commands to be
executed at a later time. It contains a vulnerability that allows local
users to execute commands as root. SGI has released patches and a
temporary solution for this problem.
References:
ftp://sgigate.sgi.com/security/19971102-01-PX
ftp://info.cert.org/pub/cert_advisories/CA-97.18.at
___
Date: 11/18/97 (CERT Advisory CA-97.11 5/1/97)
Update: SGI-libXt
Vendor: Silicon Graphics Inc.
Platforms: IRIX (4.x, 5.0.x, 5.1.x, 5.2, 5.3
6.0.x, 6.1, 6.2, 6.3, 6.4)
Silicon Graphics Inc. has released patches and a temporary solution for
the buffer overflow problems in the Xt library of the X Windowing system
and X application programs.
Reference:
ftp://sgigate.sgi.com/security/19971101-01-PX
ftp://info.cert.org/pub/cert_advisories/CA-97.11.libXt
___
Risk Factor Key:
High any vulnerability that provides an attacker with immediate
access into a machine, gains superuser access, or bypasses
a firewall. Example: A vulnerable Sendmail 8.6.5 version
that allows an intruder to execute commands on mail
server.
Medium any vulnerability that provides information that has a
high potential of giving access to an intruder. Example:
A misconfigured TFTP or vulnerable NIS server that allows
an intruder to get the password file that possibly can
contain an account with a guessable password.
Low any vulnerability that provides information that
potentially could lead to a compromise. Example: A
finger that allows an intruder to find out who is online
and potential accounts to attempt to crack passwords
via bruteforce.
Internet Security Systems, Inc., (ISS) is the pioneer and world's leading
supplier of network security assessment and intrusion detection tools,
providing comprehensive software that enables organizations to proactively
manage and minimize their network security risks. For more information,
contact the company at (800) 776-2362 or (770) 395-0150 or visit the ISS
Web site at http://www.iss.net.
________
Copyright (c) 1997 by Internet Security Systems, Inc.
Permission is hereby granted for the redistribution of this Alert Summary
electronically. It is not to be edited in any way without express consent
of X-Force. If you wish to reprint the whole or any part of this
Alert Summary in any other medium excluding electronic medium, please
email xforce@iss.net for permission.
Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties with regard to this information. In no event shall the
author be liable for any damages whatsoever arising out of or in connection
with the use or spread of this information. Any use of this information is
at the user's own risk.
X-Force PGP Key available at: http://www.iss.net/xforce/sensitive.html
as well as on MIT's PGP key server and PGP.com's key server.
Please send suggestions, updates, and comments to:
X Force <xforce@iss.net> of Internet Security Systems, Inc.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNIXFjTRfJiV99eG9AQEYIAP/fJX0ETOI5n4S+2RzwqxBTDD/6+I/byxL
BOckQwgh6wY+TeLVyh9LswfWxNw6fc5nUWjwWpwsk1sX1miuFSD/6keTCAa5scf5
SGKl0qgwqaNIKioEcFDC9FYMOhhvnlc3CgGfO+crYjjd+mClBJCniPVvQ0GWIO5l
uu3FJaDlBdA=
=JIoq
-----END PGP SIGNATURE-----