Copy Link
Add to Bookmark
Report

CIAC B-14

  

_____________________________________________________
The Computer Incident Advisory Capability
___ __ __ _ ___
/ | / \ /
\___ __|__ /___\ \___
_____________________________________________________
Information Bulletin

February 22, 1991, 1300 PST Number B-14

Additional Information about UNIX Security Problem with /bin/mail in SunOS

Sun Microsystems has released additional information about the security
problem with /bin/mail described in CIAC Bulletin B-13. There are
significant changes to the patch installation procedure. The new patch
installation procedure is:
________________________________________________________________________

Patch ID: 100224-01
BugIDs fixed by this patch: 1045636 and 1047340
Availability: Anonymous FTP from ftp.uu.net:/sun-dist/100224-01.tar.Z
Checksum of the compressed tarfile
100224-01.tar.Z = 64102 109
Patches Obsoleted: 100161-01
Obsoleted by: SysV Release 4

Patch installation instructions are as follows:

(Login as root - you must have root access to apply this patch!)
(Create a temporary directory and "cd" to it)
(Use anonymous FTP to obtain the file sun-dist/100224-01.tar.Z
from ftp.uu.net)
# uncompress 100224-01.tar
# tar xvf 100224-01.tar
# mv /bin/mail to /bin/mail.old
NEW --> # chmod 400 /bin/mail.old
# cp $arch/$os/mail to /bin/mail
(where $arch is either sun3 sun4 sun4c or sun3x)
(and where $os is either 4.0.3 4.1 or 4.1.1)
(change the permissions for the newly installed mail binary)
UPDATED --> # chmod 4711 /bin/mail
(Sun actually recommends setting the permissions to 4111,
but CIAC considers 4711 a wiser choice.)
NEW --> # ls -l /bin/mail
(Verify that /bin/mail is owned by "root" and the file
permissions are correct.)
(You will probably wish to delete the 100224-01.tar file and
the files created by "de-tar-ing" 100224-01.tar at this time!)
________________________________________________________________________


CIAC recommends that you delete /bin/mail.old altogether after
verifying that the new version of /bin/mail just installed is
functioning correctly. If you take this course of action, you should
first make a backup copy of /bin/mail.old and store it off-line.

For your information, we have included the Sun addendum below:
________________________________________________________________________

This is an addendum to the Security bulletin (#00105) that went out
recently. Two points were brought to Sun's attention by the security
community.

First point: It is not advisable to leave the old version of /bin/mail
around as this version can be exploited. After first verifying that the
new version was not mangled in the transfer, either remove the old
version (/bin/mail.old) or change the permissions to 100. example:
chmod 100 /bin/mail.old

Second point: The permissions on the new version of /bin/mail do not
have to be set to 4755 as they come on the installation tape. setting
the mode to 4111 allows /bin/mail to work, but keeps people from
reading the binary (with strings)

Special Thanks to Gordon O'Connor and Hal Brand for pointing out these
flaws in the posting.

Brad Powell
Sun Microsystems
________________________________________________________________________

For additional information or assistance contact:

Hal R. Brand
(415) 422-6312 or (FTS) 532-6312

During working hours, call CIAC at (415) 422-8193 or (FTS)
532-8193. For non-working hour emergencies , call (415)
422-7222 or (FTS) 532-7222 and ask for CIAC (this is a new
emergency number).

send e-mail to ciac@cheetah.llnl.gov (this is a new Internet
address)

send FAX messages to: (415) 423-0913 or (FTS) 543-0913

Joe Ilacqua and Sun Microsystems provided information contained in this
bulletin. Neither the United States Government nor the University of
California nor any of their employees, makes any warranty, expressed
or implied, or assumes any legal liability or responsibility for the
accuracy, completeness, or usefulness of any information, product, or
process disclosed, or represents that its use would not infringe
privately owned rights. Reference herein to any specific commercial
products, process, or service by trade name, trademark manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation, or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government nor the University of California, and shall not be used for
advertising or product endorsement purposes.

← previous
next →
loading
sending ...
New to Neperos ? Sign Up for free
download Neperos from Google Play

Let's discover also

Recent Articles

Recent Comments

Neperos cookies
This website uses cookies to store your preferences and improve the service. Cookies authorization will allow me and / or my partners to process personal data such as browsing behaviour.

By pressing OK you agree to the Terms of Service and acknowledge the Privacy Policy

By pressing REJECT you will be able to continue to use Neperos (like read articles or write comments) but some important cookies will not be set. This may affect certain features and functions of the platform.
OK
REJECT