From: Kenneth R. van Wyk (12/16/93) To: ASSIST Bulletins, Mail*Link¨ SMTP ASSIST Bulletin 93-34, Sola -----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-Certificate: MIICqjCCAhMCARAwDQYJKoZIhvcNAQECBQAwgYYxC zAJBgNVBAYTAlVTMSswKQYDVQQKEyJEZWZlbnNlIEluZm9ybWF0aW9uIFN5c3Rlb XMgQWdlbmN5MTAwLgYDVQQLEydDZW50ZXIgZm9yIEluZm9ybWF0aW9uIFN5c3Rlb XMgU2VjdXJpdHkxGDAWBgNVBAsTD0NvdW50ZXJtZWFzdXJlczAeFw05MzEyMDkxM zAwNDRaFw05NTEyMDkxMzAwNDRaMIG4MQswCQYDVQQGEwJVUzErMCkGA1UEChMiR GVmZW5zZSBJbmZvcm1hdGlvbiBTeXN0ZW1zIEFnZW5jeTEwMC4GA1UECxMnQ2Vud GVyIGZvciBJbmZvcm1hdGlvbiBTeXN0ZW1zIFNlY3VyaXR5MRgwFgYDVQQLEw9Db 3VudGVybWVhc3VyZXMxEzARBgNVBAsTCk9wZXJhdGlvbnMxGzAZBgNVBAMTEktlb m5ldGggUi4gdmFuIFd5azCBmjAKBgRVCAEBAgIEAAOBiwAwgYcCgYEA87an/VaSD dGo6vyWxeuYagddw7CFtKmrgvExfmcie7QUd7Nd63b31AK6tBeu4LLTsaKXR8d9O yzu+MWQFPS0QkfAa501U3AhSGmdJK8I1sIyGHnIXtiDI6dWDR7d/kFfFCFi1Skbv b5wQzZzwSg5xGJgZLunVwtKkP2dxV8hC+cCAQMwDQYJKoZIhvcNAQECBQADgYEAG B808ZN0Egrl+/A7tXicIVtm9OEMsWVc+P36oh9Ql/IZHc0C5tt4ZrXyeWSXIKlnR cEIHkJqXlBs3/THCZzZqFCJG1rki7kxKNrmmqB2+/bnfK2ZUBjVnW3cHeoEnv/VI MaNWjcrdc+DQpP8pXojfTvxnTuawSOSvyhs13RUC0s= Issuer-Certificate: MIICNTCCAZ4CARswDQYJKoZIhvcNAQECBQAwRDELMAkGA 1UEBhMCVVMxCzAJBgNVBAgTAk1EMSgwJgYDVQQKEx9UcnVzdGVkIEluZm9ybWF0a W9uIFN5c3RlbXMgUENBMB4XDTkzMTExMDIxMjIxNloXDTk0MDIxODIxMjIxNlowg YYxCzAJBgNVBAYTAlVTMSswKQYDVQQKEyJEZWZlbnNlIEluZm9ybWF0aW9uIFN5c 3RlbXMgQWdlbmN5MTAwLgYDVQQLEydDZW50ZXIgZm9yIEluZm9ybWF0aW9uIFN5c 3RlbXMgU2VjdXJpdHkxGDAWBgNVBAsTD0NvdW50ZXJtZWFzdXJlczCBmjAKBgRVC AEBAgIEAAOBiwAwgYcCgYEA19l6BN7iTGYEU61qJETIjBh3iAeHzoL8sZ5KwFRZD S/a1KnYlD1zJHR/KeQCOBWW2HzX43TFLCNGU7UD9i6m8AymLe5IJf/bGh0Rne7Jd Q1GAOLw7/J4hE57IMbGETZpzeU1D9IYxiERRNio/oa422lUlS9JZHLA5jaPNcUrX P8CAQMwDQYJKoZIhvcNAQECBQADgYEAtk4EYPgH0//H896t95E+4m8zWRxwyAULr a5wWThZ1TNjwdDQ3HbYC2IhXUA2N2Vzic5SWBFI6BRmEjWQrrgUNi4a26zZc6jiS 3OebUYo75t1kkzyRaEf0o3DPnkvo0FQziUJaFpu6Z1/+ZoGu4UURwr/jaA+g1oZC 6kDyRnygWc= Issuer-Certificate: MIIB8jCCAVsCAQEwDQYJKoZIhvcNAQECBQAwRDELMAkGA 1UEBhMCVVMxCzAJBgNVBAgTAk1EMSgwJgYDVQQKEx9UcnVzdGVkIEluZm9ybWF0a W9uIFN5c3RlbXMgUENBMB4XDTkzMDUyODE3MTEyN1oXDTk1MDUyODE3MTEyN1owR DELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1EMSgwJgYDVQQKEx9UcnVzdGVkIEluZ m9ybWF0aW9uIFN5c3RlbXMgUENBMIGaMAoGBFUIAQECAgQAA4GLADCBhwKBgQDbL xaRlS3u54yyRgVDI5dcE9nlasL8fJqOGlyo7xH2FZnr3kUfsFj7OGiYsr6UbvqwK nyfMIRUrXDUa64leGmft3SK27psDUHOynRSCc40d/HrDf810U5tnTamBKUIMqivK 4GoL0tMRA1eX6hALAvLLgK1HbnwZAo6GqQGW8CIJQIBAzANBgkqhkiG9w0BAQIFA AOBgQDBp5aC6oV6IuFi8JCctq57bew604HHNllgjjp7zdXafq6jctRg2g91k/yFW h19bJC/tNrb0WVwuZOs5L/FToPMNIIHzaW/YSROBmyhTDYaKHZGj0P1+iNjMbHt9 dm1QEHGIfKgBwFidItnOa74DfkXdijlPRnr/+E2Ib6PM+hEfQ== MIC-Info: RSA-MD5,RSA,PLdi2XeiKdpHsz+1n3OsdGrR/RM6UxYP2gWzHQUSJDS /9LJmU4ZqmonAFz02AghsLRigPFxDeRTt+PfWcpIiZwAa3EtIk89UW5nObvy+By/ is86ri3C1YV4DTXfkSiAJu1gYOifGWqQiQ9rchWG7u1pKMolyI3H1glZVmyl8mqs = <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Automated Systems Security Incident Support Team _____ ___ ___ _____ ___ _____ | / /\ / \ / \ | / \ | | / Integritas / \ \___ \___ | \___ | | < et /____\ \ \ | \ | | \ Celeritas / \ \___/ \___/ __|__ \___/ | |_____\ <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Bulletin 93-34 Release date: 16 December 1993, 1530 EST Subject: Solaris System Startup Vulnerability Summary: This bulletin provides information about a vulnerability in the system startup scripts on Solaris 2.X and Solaris x86 systems. The changes described below will be integrated into the upcoming Solaris release. Description: If fsck(8) fails during system boot, a privileged shell is run on the system console. This behavior can represent a security vulnerability if users, who would normally not have root access, have physical access to the console at boot time. An attacker can force the failure to occur. Impact: This vulnerability allows anyone with physical access to the system console to gain root access. Solution: A simple change to each of two system scripts can be used to close this potential security hole. The new behavior will cause the system to run the privileged shell only if the user at the console enters the correct root password. If you wish to make the change on your own systems, edit both /sbin/rcS and /sbin/mountall, changing every occurrence of: /sbin/sh < /dev/console to: /sbin/sulogin < /dev/console As distributed by Sun, /sbin/rcS contains one occurrence of this string, at line 152; and /sbin/mountall contains two, one at line 66 and one at line 250. Once these changes are made, sulogin will request the root password in the event fsck(8) fails, before starting a privileged shell. The success or failure of sulogin will be logged in /var/adm/sulog. ASSIST wishes to thank CERT Coordination Center and Sun Microsystems, Inc. for information contained in this bulletin. ASSIST is an element of the Defense Information Systems Agency (DISA), Center for Information Systems Security (CISS), that provides service to the entire DoD community. If you have any questions about ASSIST or computer security issues, contact ASSIST using one of the methods listed below. If you would like to be included in the distribution list for these bulletins, send your Milnet (Internet) e-mail address to assist-request@assist.ims.disa.mil. Back issues of ASSIST bulletins are available on the ASSIST bbs (see below), and through anonymous ftp from assist.ims.disa.mil. ASSIST contact information: PHONE: 703-756-7974, DSN 289, duty hours are 06:30 to 17:00 Monday through Friday. During off duty hours, weekends, and holidays, ASSIST can be reached via pager at 800-SKY-PAGE (800-759-7243) PIN 2133937. Your page will be answered within 30 minutes, however if a quicker response is required, prefix your phone number with "999" and ASSIST will return your call within 5 minutes. ELECTRONIC MAIL: assist@assist.ims.disa.mil. ASSIST BBS: 703-756-7993/4, DSN 289, leave a message for the "sysop". Privacy Enhanced Mail (PEM): ASSIST uses PEM, a public key encryption tool, to digitally sign all bulletins that are distributed through e-mail. The section of seemingly random characters between the "BEGIN PRIVACY-ENHANCED MESSAGE" and "BEGIN ASSIST BULLETIN" contains machine-readable digital signature information generated by PEM, not corrupted data. PEM software for UNIX systems is available from Trusted Information Systems (TIS) at no cost, and can be obtained via anonymous FTP from ftp.tis.com (IP 192.94.214.100). Note: The TIS software is just one of several implementations of PEM currently available and additional versions are likely to be offered from other sources in the near future. -----END PRIVACY-ENHANCED MESSAGE----- ------------------ RFC822 Header Follows ------------------ Received: by smtpqm.llnl.gov with SMTP;16 Dec 1993 12:44:04 -0800 Return-path: krvw@assist.ims.disa.MIL Received: from icdc.llnl.gov by icdc.llnl.gov (PMDF #3384 ) id <01H6JQE31JK096VO6B@icdc.llnl.gov>; Thu, 16 Dec 1993 12:43:16 PST Received: from pierce.llnl.gov by icdc.llnl.gov (PMDF #3384 ) id <01H6JQDE3EF496VO81@icdc.llnl.gov>; Thu, 16 Dec 1993 12:42:52 PST Received: by pierce.llnl.gov (4.1/LLNL-1.18/llnl.gov-05.92) id AA03331; Thu, 16 Dec 93 12:43:44 PST Received: from cheetah.llnl.gov by pierce.llnl.gov (4.1/LLNL-1.18/llnl.gov-05.92) id AA03315; Thu, 16 Dec 93 12:43:36 PST Received: from pierce.llnl.gov (pierce.llnl.gov [128.115.18.253]) by cheetah.llnl.gov (8.6.4/8.6.4) with SMTP id MAA14365 for ; Thu, 16 Dec 1993 12:42:23 -0800 Received: by pierce.llnl.gov (4.1/LLNL-1.18/llnl.gov-05.92) id AA03290; Thu, 16 Dec 93 12:43:29 PST Received: from assist.ims.disa.mil by pierce.llnl.gov (4.1/LLNL-1.18/llnl.gov-05.92) id AA03219; Thu, 16 Dec 93 12:42:33 PST Received: from bull-run.ims.disa.mil by assist.ims.disa.mil (4.1/2.4) id AA03407; Thu, 16 Dec 93 15:36:23 EST Received: by bull-run.ims.disa.mil (4.1/2.4) id AA06318; Thu, 16 Dec 93 15:37:46 EST Date: 16 Dec 1993 15:37:13 -0500 From: "Kenneth R. van Wyk" Subject: ASSIST Bulletin 93-34, Solaris System Startup Vulnerability Resent-to: BILL_ORVIS@QUICKMAIL.llnl.GOV To: ASSIST Bulletins Resent-message-id: <01H6JQE33YCY96VO6B@icdc.llnl.gov> Message-id: <9312162037.AA06318@bull-run.ims.disa.mil> X-Envelope-to: BILL_ORVIS@QUICKMAIL.llnl.gov X-VMS-To: IN%"ASSIST-Bulletins@assist.ims.disa.MIL" "ASSIST Bulletins" Content-transfer-encoding: 7BIT ======================================================================