________________________________________________________________________

              THE COMPUTER INCIDENT ADVISORY CAPABILITY



                                 CIAC



                         INFORMATION BULLETIN

________________________________________________________________________



             SunView/SunTools selection_svc Vulnerability 



August 23, 1990, 1600 PST                                   Number A-32



CIAC has been advised that there is a vulnerability (Sun Bug ID

1039576) in systems running SunView under SunOS 4.x (or SunTools under

SunOS 3.x).  The SunView/SunTools selection_svc facility may allow a

remote user unauthorized access to selected files from a computer

running SunView.   The problem exists in Sun3 and Sun4 platforms

running SunOS 3.x, 4.0, 4.0.1, 4.0.3, and 4.1 as well as 386i platforms

running SunOS 4.0, 4.01, and 4.0.2.   Because the selection_svc process

continues to run until terminated, this vulnerability can be exploited

even after a user changes to another window system after running

SunView/SunTools or logs off the system.  (The problem is in

SunView/SunTools, however, and not with other window systems such as

X11.)  CERT/CC provides additional details:



    On Sun3 and Sun4 systems, a remote system can read any file that is

    readable to the user running SunView.  On the 386i, a remote system 

    can read any file on the workstation running SunView regardless of

    protections.  Note that if root runs Sunview, all files are 

    potentially accessible by a remote system.  If the password file with 

    the encrypted passwords is world readable, an intruder can take the 

    password file and attempt to guess passwords.



A patch for this vulnerability is available for Sun 4.x systems.  Call 

your local Sun answer center, phone (800) USA-4SUN, anonymous ftp into 

sun-fixes on uunet.uu.net, or send e-mail to:



    security-features@sun.com 



Sun Microsystems has recently established a customer warning system for

reporting new vulnerabilities and disseminating relevant information.

Send e-mail to:



        security-alert@sun.com



or leave a message on the voice mail system at (415) 336-7205.  Please 

also advise CIAC of any new vulnerabilities you may discover.

 

For additional information or assistance, please contact CIAC: 



        David Brown

        (415) 423-9878 or (FTS) 543-9878

        FAX:  (415) 423-0913, (FTS) 543-0913 or (415) 422-4294



CIAC's 24-hour emergency hot-line number is (415) 971-9384.   If you

call the emergency number and there is no answer, please let the number

ring until voice mail comes on.  Please leave a voice mail message;

someone will return your call promptly.  You may send e-mail to:



        ciac@tiger.llnl.gov

 

CERT/CC and Brad Powell of Sun Microsystems provided information

included in this bulletin.  Neither the United States Government nor

the University of California nor any of their employees, makes any

warranty,  expressed or implied, or assumes any legal liability or

responsibility for the accuracy, completeness, or usefulness of any

information, product, or process disclosed, or represents that its use

would not infringe privately owned rights.  Reference herein to any

specific commercial products, process, or service by trade name,

trademark manufacturer, or otherwise, does not necessarily constitute

or imply its endorsement, recommendation, or favoring by the United

States Government or the University of California.  The views and

opinions of authors expressed herein do not necessarily state or

reflect those of the United States Government nor the University of

California, and shall not be used for advertising or product

endorsement purposes.