_____________________________________________________

             The Computer Incident Advisory Capability

                         ___  __ __    _     ___

                        /       |     / \   /

                        \___  __|__  /___\  \___

        _____________________________________________________

                         Information Bulletin



         Vulnerability in UNIX System V on 386/486 Platforms

                                   

     Critical UNIX System V on 386/486  Vulnerability Information

--------------------------------------------------------------------------

PROBLEM:   UNIX System V security problem on 386/486 platforms (UAREA bug).

PLATFORM: UNIX System V for the Intel 80386/80486 based computers.

DAMAGE:   Allows privileged access to files by non-privileged users.

SOLUTIONS: Patch/update available from various vendors.

IMPACT OF PATCH:  Vulnerability eliminated.  No other side-effects reported.

--------------------------------------------------------------------------

March 21, 1991, 1200 PST                                Number B-19



CIAC has learned of a vulnerability that allows privileged access to

files on some versions of UNIX System V running on an Intel

80386/80486 based computer. This problem known as the UAREA bug, has

been corrected by AT&T.  Most vendors of UNIX System V based on the

AT&T software have recently released patches specifically designed for

their products.  This bulletin provides a partial list of vendors that

are providing patches for this problem, as well as vendors whose

product never had the vulnerability in a specified release.



The following vulnerability matrix table lists each of vendor/version

combination for which CIAC has received information.  For each vendor,

the listed versions were tested for this vulnerability, and a patch

was developed for those versions found to be vulnerable.  If the

vendor/version combination does not exhibit the vulnerability,

"No" appears in the third column.



 Vendor                    Version       Exhibits vulnerability

 ------------------------  ---------     ---------------------

 Dell                      SVR3.2/1.0.6  Yes - patch available

 Dell                      SVR3.2/1.1    No

 Dell                      SVR4.0/2.0    No

 Interactive               2.0.2         Yes - patch available

 Interactive               2.2           Yes - patch available

 Interactive               2.2.1         Yes - patch available

 Everex (ESIX)             Rev. D        Yes - patch available

 AT&T                      SVR3.2.0      Yes - patch available

 AT&T                      SVR3.2.1      No

 SCO                       all versions  No

 Microport                 2.2           No



Most vendors are aware of this bug, and have taken steps to correct

the problem.  If your vendor/version of UNIX is not listed, or is

listed as one of those that exhibits the vulnerability, you should

contact your UNIX System V vendor for the patch.





 For additional information or assistance, please contact CIAC:   

 

        Hal Brand

        (415) 422-6312 or (FTS) 532-6312



        During working hours call CIAC at (415) 422-8193 or (FTS)

532-8193 or send e-mail to ciac@cheetah.llnl.gov.

    

        Send FAX messages to:  (415) 423-0913 or (FTS) 543-0913



This document was prepared as an account of work sponsored by an

agency of the United States Government. Neither the United States

Government nor the University of California nor any of their

employees, makes any warranty, express or implied, or assumes any

legal liability or responsibility for the accuracy, completeness, or

usefulness of any information, apparatus, product, or process

disclosed, or represents that its use would not infringe privately

owned rights. Reference herein to any specific commercial products,

process, or service by trade name, trademark, manufacturer, or

otherwise, does not necessarily constitute or imply its endorsement,

recommendation or favoring by the United States Government or the

University of California. The views and opinions of authors expressed

herein do not necessarily state or reflect those of the United States

Government or the University of California, and shall not be used for

advertising or product endorsement purposes.