__________________________________________________________

                       The U.S. Department of Energy
                   Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

   Sun aspppls(1M) does not create the temporary file /tmp/.asppp.fifo safely
                             [Sun Alert ID: 46903]

October 2, 2003 17:00 GMT                                         Number O-001
______________________________________________________________________________
PROBLEM:       May be possible to overwrite or create any file on a Solaris 8 
               system due to a security issue with aspppls(1M). 
PLATFORM:      SPARC Solaris 8, INTEL Solaris 8 
               (Note-Solaris 2.5.1, 2.6, 7, & 9 are not affected by this issue.) 
DAMAGE:        A unprivileged local user may gain unauthorized root 
               privileges. 
SOLUTION:      Apply upgrades or there are workarounds available. 
______________________________________________________________________________
VULNERABILITY  The risk is MEDIUM. It is possible for an attacker to gain 
ASSESSMENT:    unauthorized root privileges. 
______________________________________________________________________________
LINKS: 
 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/o-001.shtml 
 ORIGINAL BULLETIN:  http://www.sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert
                     %2F46903&zone_32=category%3Asecurity 
______________________________________________________________________________
[***** Start Sun Alert ID: 46903 *****]

Sun(sm) Alert Notification 
Sun Alert ID: 46903 
Synopsis: aspppls(1M) Does Not Create the Temporary File /tmp/.asppp.fifo Safely 
Category: Security 
Product: Solaris 
BugIDs: 4683015 
Avoidance: Patch 
State: Resolved 
Date Released: 09-Sep-2002 
Date Closed: 09-Sep-2002 
Date Modified: 

1. Impact 
A local unprivileged user may be able overwrite or create any file on a Solaris 8 
system which could lead to a unprivileged local user gaining unauthorized root 
privileges due to a security issue with aspppls(1M). 

Sun acknowledges with thanks, Kevin Kotas of eSecurityOnline for bringing this 
issue to our attention. 

2. Contributing Factors 
This issue can occur in the following releases: 

SPARC 

Solaris 8 without patch 111299-04 

Intel 

Solaris 8 without patch 111300-04 
Note: Solaris 2.5.1, 2.6, 7, and 9 are not affected by this issue. 

3. Symptoms 
There are no predictable symptoms that would show the described issue has been 
exploited, as it depends on which file is overwritten or created. 


Solution Summary Top 

4. Relief/Workaround 
If asynchronous PPP is not being used at the customer site, the setuid permissions 
on the aspppls(1M) binary could be removed via the following command run as root: 

	# chmod u-s /usr/sbin/aspppls                        
	
The asynchronous PPP packages could also be removed if asynchronous PPP is not being 
used via the following command run as root: 

	# pkgrm SUNWapppr SUNWpppdu                        

5. Resolution 
This issue is addressed in the following releases: 

SPARC 

Solaris 8 with patch 111299-04 or later 

Intel 

Solaris 8 with patch 111300-04 or later 

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun 
Alert notification may contain information provided by third parties. The issues 
described in this Sun Alert notification may or may not impact your system(s). Sun 
makes no representations, warranties, or guarantees as to the information contained 
herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION 
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, 
ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN 
NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL 
DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. 
This Sun Alert notification contains Sun proprietary and confidential information. It 
is being provided to you pursuant to the provisions of your agreement to purchase 
services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. 
This Sun Alert notification may only be used for the purposes contemplated by these 
agreements. 

Copyright 2001, 2002 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, 
CA 95054 U.S.A. All rights reserved


[***** End Sun Alert ID: 46903 *****]
_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of Sun Microsystems for the 
information contained in this bulletin.
_______________________________________________________________________________


CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604
    E-mail:   ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:      http://www.ciac.org/
   Anonymous FTP:       ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

N-150: Red Hat Updated KDE packages fix security issues
N-151: OpenSSH Buffer Management Error
N-152: Real Networks Streaming Server Vulnerability
N-153: New Worms and Helpful Computer Users
N-154: IBM DB2 Buffer Overflow Vulnerabilities
N-155: Red Hat Updated Perl packages fix security issues
N-156: ProFTPD ASCII File Remote Compromise Vulnerability
N-157: CERT/CC Vulnerability Note OpenSSH PAM challenge authentication failure
N-158: CERT/CC Vulnerability Note Portable OpenSSH server PAM
N-159: OpenSSL Security Advisory vulnerabilities in ASN.1 parsing