__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Sun ypserv and ypxfrd Vulnerabilities [Sun Alert ID: 57554] May 14, 2004 21:00 GMT Number O-144 ______________________________________________________________________________ PROBLEM: Solaris 9 systems running as NIS servers may have patches that might allow access to secure map information such as stored encrypted passwords. PLATFORM: Solaris 9 (used in a NIS environment) DAMAGE: Local or remote unprivileged users may gain access to sensitive information. SOLUTION: Apply appropriate patches. ______________________________________________________________________________ VULNERABILITY The risk is LOW. While a local or remote unprivileged user may ASSESSMENT: gain access to encrypted passwords, other means would be necessary to execute a more damaging exploit. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/o-144.shtml ORIGINAL BULLETIN: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57554-1 ______________________________________________________________________________ [***** Start Sun Alert ID: 57554 *****] Sun(sm) Alert Notification Sun Alert ID: 57554 Synopsis: Solaris 9 Patches WITHDRAWN - Security Vulnerability With ypserv(1M) and ypxfrd(1M) Category: Security Product: Solaris BugIDs: 5022150 Avoidance: Patch, Workaround State: Resolved Date Released: 30-Apr-2004, 12-May-2004 Date Closed: 12-May-2004 Date Modified: 12-May-2004 1. Impact Solaris 9 systems running as NIS servers containing secure maps and with patches 113579-02 through 113579-05 (for SPARC) or 114342-02 through 114342-05 (for x86) installed may allow local or remote unprivileged users (in an NIS environment) access to secure map information. Secure maps such as "passwd.adjunct.byname" are typically used to store encrypted passwords and other sensitive information and are not viewable to unprivileged users. Patches 113579-02 through 113579-05 and 114342-02 through 114342-05 have been WITHDRAWN and are no longer available on SunSolve. 2. Contributing Factors This issue can occur in the following releases: SPARC Platform Solaris 9 with patches 113579-02 through 113579-05 and without patch 113579-06 x86 Platform Solaris 9 with patches 114342-02 through 114342-05 and without patch 114342-06 Note: Solaris 7 and 8 are not affected by this issue. This issue only affects NIS servers containing secure maps. NIS secure maps are stored on the server as dbm(3UCB) files with YP_SECURE as one of the keys in the database. Standard default secure maps (if they exist on the server) would be: audit_user group.adjunct.byname passwd.adjunct.byname The following script when run as "root" can help in finding secure maps that may be present: #!/bin/bash for i in `ls -1 /var/yp/*/*.pag | sed -e s/\.pag//` do makedbm -u $i | grep YP_SECURE 2>&1 > /dev/null; if [ $? -eq 0 ]; then echo $i is a secure map fi done 3. Symptoms Unprivileged local or remote users may be able to view secure maps using commands such as ypmatch(1) or ypcat(1). For example, if "audit_user" is configured to be a secure map on the NIS server, then the following command can be run by any user on an NIS client system: $ ypcat audit_user to determine the contents of the map, which is typically visible only to the "root" user. 4. Relief/Workaround To work around the described issue, back out patches 113579-02 through 113579-05 (for SPARC) or 114342-02 through 114342-05 (for x86). After backing out the patches, NIS services must be stopped and restarted using the following commands: # /usr/lib/netsvc/yp/ypstop # /usr/lib/netsvc/yp/ypstart Note: Systems installed with Solaris 9 Update 12/03 and 4/04 cannot back out the affected patches. 5. Resolution This issue is addressed in the following releases: SPARC Platform Solaris 9 with patch 113579-06 or later x86 Platform Solaris 9 with patch 114342-06 or later Change History 12-May-2004: Update Contributing Factors and Resolution sections for patch release Re-release as Resolved This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2004 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. [***** End Sun Alert ID: 57554 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Sun Microsystems for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) O-134: Debian rsync O-135: Apple QuickTime Integer Overflow O-136: HP Web JetAdmin Vulnerabilities O-137: SGI IRIX Networking Security Vulnerabilities O-138: Mac OS X Jaguar and Panther Security Vulnerabilities O-139: Apple Mac OS X AppleFileServer Authentication Vulnerability O-140: Microsoft HCP Protocol URL Validation Vulnerability O-141: Symantec Client Firewall Remote Access Vulnerabilities O-142: Hewlett Packaged HP-UX dtlogin Vulnerability O-143: Gnome Toolkit (GTK+) Support Libraries Vulnerability