Date: 12/14/97 10:14:35 PM From: X-Force Subject: BoS: ISS Security Alert Summary v1 n8 To: (""@LOCAL) CC: ("X-Force "@LOCAL) -----BEGIN PGP SIGNED MESSAGE----- ISS Security Alert Summary December 3, 1997 Volume 1 Number 8 X-Force Vulnerability and Threat Database: http://www.iss.net/xforce To receive these Alert Summaries, subscribe to the ISS Alert mailing list by sending an email to majordomo@iss.net and within the body of the message type: 'subscribe alert'. ___ Index 4 Reported New Vulnerabilities - SCO-scoterm - land-dos - SGI-syserr - SGI-permtool 4 Updates - Cisco-passwdloss - HP-ppl - SGI-at - SGI-libXt Risk Factor Key ___ Date Reported: 11/20/97 Vulnerability: SCO-scoterm Affected Platforms: SCO Open Desktop/Open Server 3.0 SCO OpenServer 5.0 Risk Factor: High Santa Cruz Operation Open Server's xterm, scoterm, has a vulnerability that, if exploited, would allow any local user to execute arbitrary commands with root privileges. SCO provides a workaround as well as a patch for this problem. References: ftp://ftp.sco.COM/SSE/security_bulletins/SB.97:02a http://ciac.llnl.gov/ciac/bulletins/i-016.shtml ___ Date Reported: 11/19/97 Vulnerability: land-dos Affected Platforms: (From BUGTRAQ@NETSPACE.ORG 11/24, second hand information not meant to be comprehensive/accurate, contact vendor for exact operating systems and versions) AIX (3) AmigaOS AmiTCP (4.2 (Kickstart 3.0)) BeOS Preview (Release 2 PowerMac) BSDI (2.0, 2.1 (vanilla)) Cisco IOS/700 Cisco Catalyst 5xxx and 29xx switches Digital VMS FreeBSD (2.2.5-Release, 2.2.5-Stable, 3.0-Current) HP External JetDirect Print Servers IBM AS/400 OS7400 (3.7) IRIX (5.2, 5.3) MacOS MacTCP MacOS (7.6.1 (OpenTransport 1.1.2), 8.0) NetApp NFS server (4.1d, 4.3) NetBSD (1.1, 1.2, 1.2a, 1.2.1, 1.3_ALPHA) NeXTSTEP (3.0, 3.1) OpenVMS (7.1 with UCX 4.1-7) QNX (4.24) Rhapsody Developer Release SCO OpenServer (5.0.2 SMP, 5.0.4) SCO Unixware (2.1.1, 2.1.2) SunOS (4.1.3, 4.1.4) Windows 95 (vanilla) Windows 95 (with Winsock 2 and VIPUPD.EXE) Windows NT (with SP3, with SP3 and simptcp-fix) Risk Factor: High A new bug called the land attack named by its discoverer, has been posted to a security mailing list, BUGTRAQ, with an exploit that can lock up or "freeze" many different operating systems as well as network hardware. An attacker can send a SYN packet, which is normally used to open a connection, to the host they want to attack. The packet is spoofed to appear to the machine that it is coming from itself, from the same port. When the machine tries to respond to itself multiple times, it crashes. Many different operating systems and hardware such as routers, and hubs have been reported to being vulnerable to this bug. Packet filters that protect against IP address spoofing will be effective in preventing Internet-launched land attacks. Cisco has released information on how to configure their hardware to avoid this problem. References: http://www.iss.net/xforce/advisories/land1.asc (original BUGTRAQ post) http://www.iss.net/xforce/advisories/land2.asc (affected platforms) http://www.cisco.com/warp/public/770/land-pub.shtml ftp://ietf.org/internet-drafts/draft-ferguson-ingress-filtering-03.txt ___ Date Reported: 11/18/97 Vulnerability: SGI-syserr Affected Platforms: All SGI systems running Desktop System Monitor Risk Factor: High IRIX's syserr is the System Error Notification Broker program and is part of the Desktop System Monitor. It monitors system events and notifies the user when the events occur. A vulnerability exists in syserr that allows local accounts to create and corrupt random files. Reference: ftp://sgigate.sgi.com/security/19971103-01-PX ___ Date Reported: 11/18/97 Vulnerability: SGI-permtool Affected Platforms: All SGI systems running Indigo Magic Desktop Risk Factor: High Indigo Magic Desktop contains a program called permissions tool. It is used to modify the permission bits (owner, group, and others) for files and directories (similar to chmod). It contains a vulnerability that allows local accounts to gain access to a privileged user. Reference: ftp://sgigate.sgi.com/security/19971103-01-PX ___ Date: 11/25/97 (ISS Security Alert Summary v1 n7) Update: Cisco-passwdloss Vendor: Cisco Platforms: LocalDirector 1.6.3 Cisco has investigated the password loss problem in LocalDirector 1.6.3 and was unable to reproduce it. They believe that the reports were caused by an error on the user's end. Cisco is currently fixing the user interface to make it more difficult for the user to lose their password without knowing it. Cisco is still trying to reproduce this to make sure their assessment is correct. Reference: http://www.cisco.com/warp/public/770/ldpass-pub.shtml ___ Date: 11/24/97 (HP Security Bulletin #00057 4/22/97) Update: HP-ppl Vendor: Hewlett Packard Platforms: HP-UX (9.x, 10.x) Hewlett Packard has released new patches for the ppl vulnerability that was disclosed in April (HP has *revised* HP Security Bulletin #00057). References: http://us-support.external.hp.com - HP Security Bulletin #00057 http://ciac.llnl.gov/ciac/bulletins/i-31a.shtml ___ Date: 11/18/97 (CERT Advisory CA-97.18 6/12/97) Update: SGI-at Vendor: Silicon Graphics Inc. Platforms: IRIX (3.x, 4.x, 5.0.x, 5.1.x, 5.2, 5.3 6.0.x, 6.1, 6.2, 6.3, 6.4) The at program can be used by local users to schedule commands to be executed at a later time. It contains a vulnerability that allows local users to execute commands as root. SGI has released patches and a temporary solution for this problem. References: ftp://sgigate.sgi.com/security/19971102-01-PX ftp://info.cert.org/pub/cert_advisories/CA-97.18.at ___ Date: 11/18/97 (CERT Advisory CA-97.11 5/1/97) Update: SGI-libXt Vendor: Silicon Graphics Inc. Platforms: IRIX (4.x, 5.0.x, 5.1.x, 5.2, 5.3 6.0.x, 6.1, 6.2, 6.3, 6.4) Silicon Graphics Inc. has released patches and a temporary solution for the buffer overflow problems in the Xt library of the X Windowing system and X application programs. Reference: ftp://sgigate.sgi.com/security/19971101-01-PX ftp://info.cert.org/pub/cert_advisories/CA-97.11.libXt ___ Risk Factor Key: High any vulnerability that provides an attacker with immediate access into a machine, gains superuser access, or bypasses a firewall. Example: A vulnerable Sendmail 8.6.5 version that allows an intruder to execute commands on mail server. Medium any vulnerability that provides information that has a high potential of giving access to an intruder. Example: A misconfigured TFTP or vulnerable NIS server that allows an intruder to get the password file that possibly can contain an account with a guessable password. Low any vulnerability that provides information that potentially could lead to a compromise. Example: A finger that allows an intruder to find out who is online and potential accounts to attempt to crack passwords via bruteforce. Internet Security Systems, Inc., (ISS) is the pioneer and world's leading supplier of network security assessment and intrusion detection tools, providing comprehensive software that enables organizations to proactively manage and minimize their network security risks. For more information, contact the company at (800) 776-2362 or (770) 395-0150 or visit the ISS Web site at http://www.iss.net. ________ Copyright (c) 1997 by Internet Security Systems, Inc. Permission is hereby granted for the redistribution of this Alert Summary electronically. It is not to be edited in any way without express consent of X-Force. If you wish to reprint the whole or any part of this Alert Summary in any other medium excluding electronic medium, please email xforce@iss.net for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. X-Force PGP Key available at: http://www.iss.net/xforce/sensitive.html as well as on MIT's PGP key server and PGP.com's key server. Please send suggestions, updates, and comments to: X Force of Internet Security Systems, Inc. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNIXFjTRfJiV99eG9AQEYIAP/fJX0ETOI5n4S+2RzwqxBTDD/6+I/byxL BOckQwgh6wY+TeLVyh9LswfWxNw6fc5nUWjwWpwsk1sX1miuFSD/6keTCAa5scf5 SGKl0qgwqaNIKioEcFDC9FYMOhhvnlc3CgGfO+crYjjd+mClBJCniPVvQ0GWIO5l uu3FJaDlBdA= =JIoq -----END PGP SIGNATURE-----