_____________________________________________________
             The Computer Incident Advisory Capability
                         ___  __ __    _     ___
                        /       |     / \   /
                        \___  __|__  /___\  \___
        _____________________________________________________
                           INFORMATION BULLETIN 

	  New TFTPD server available for IBM RS6000 systems

October 7, 1991, 1400 PDT	                             Number C-1

-----------------------------------------------------------------------------
PROBLEM: All world readable files can be remotely retrieved using TFTP
	on IBM RS6000 systems running AIX. 
PLATFORM: IBM RS6000 systems running versions of AIX prior to the 2009 update.  
DAMAGE: Potential unauthorized access and disclosure of critical
	system files.
SOLUTIONS:   Request and install TFTPD patch APAR number ix22628 from 
	IBM; this patch limits the access of TFTP to specified directories.  
-----------------------------------------------------------------------------
	      Critical Facts about the new TFTPD server

CIAC has learned of a version of TFTPD available for IBM RS6000
systems running AIX.  This version will eliminate a problem in current
versions of TFTPD that allows potential unauthorized access and
disclosure of world-readable (including critical system) files by
adding a feature that denies access to sensitive areas of the system.
This program continues to support tftp access (which is required to
support X-Terminals).  This new TFTPD server uses a configuration file
(/etc/tftpaccess.ctl) to allow or deny access to specific directories
and sub-directories before permitting any transfer of data.

During TFTP access the file /etc/tftpaccess.ctl is searched for lines
that start with "allow:" or "deny:" All other lines are ignored.  If
the file does not exist, the access is allowed in the currently
supported fashion.  For example, the /usr directory might be allowed
and the /usr/ucb directory might be denied.  This means that any
directory or file in the /usr directory except the /usr/ucb directory
can be accessed.  The entries in the /etc/tftpaccess.ctl file must be
absolute path names.  The permissions on the /etc/tftpaccess.ctl file
should be writable only by the root user (mode 0644).

IBM RS6000 customers may request this implementation of TFTPD by
calling IBM Service and requesting APAR number ix22628.  This version
of TFTPD will appear in the 2009 update and the next release of AIX.
To install this new version of TFTPD, replace your current version of
/etc/tftpd with the patched program and follow the provided
instructions for setting up a /etc/tftpaccess.ctl file with the
appropriate "allow:" or "deny:" lines.  Please contact IBM or CIAC
for assistance.

	Tom Longstaff
	(510) 423-4416**/(FTS) 543-4416
	longstaf@llnl.gov

Send e-mail to ciac@llnl.gov or call CIAC at (510) 422-8193**/(FTS)
532-8193.  FAX messages to: (510) 423-8002**/(FTS) 543-8002.

Previous CIAC bulletins and other information is available via
anonymous ftp from irbis.llnl.gov (ip address 128.115.19.60).  
 
**Note area code has changed from 415, although the 415 area code will
work until Jan. 1992.

Neither the United States Government nor the University of California
nor any of their employees, makes any warranty, expressed or implied,
or assumes any legal liability or responsibility for the accuracy,
completeness, or usefulness of any information, product, or process
disclosed, or represents that its use would not infringe privately
owned rights.  Reference herein to any specific commercial products,
process, or service by trade name, trademark manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation, or favoring by the United States Government or the
University of California.  The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government nor the University of California, and shall not be used for
advertising or product endorsement purposes.