Original issue date: March 27, 1991<BR>
Last revised: September 18, 1997<BR>
Attached copyright statement

<P>A complete revision history is at the end of this file.

<CENTER>
<H4>*** THIS IS A REVISED CERT ADVISORY ***</H4>
<H4>*** CONTAINS NEW INFORMATION AND A CORRECTION ***</H4>
</CENTER>
<HR>
<H2>I. Description</H2>

<P>The Computer Emergency Response Team/Coordination Center (CERT/CC)
has obtained information from Sun Microsystems, Inc. regarding a
vulnerability affecting SunOS 4.1 and 4.1.1 versions of in.telnetd on
all Sun 3 and Sun 4 architectures.  This vulnerability also affects
SunOS 4.0.3 versions of both in.telnetd and in.rlogind on all Sun3 and
Sun 4 architectures.  To our knowledge, a vulnerability does not exist
in the SunOS 4.1 and 4.1.1 versions of in.rlogind.  The vulnerability
has been fixed by Sun Microsystems, Inc.

<P>This advisory has been revised to include information on the new
patches available for SunOS 4.0.3.  The CERT would also like to
mention that the name of the compressed tarfile included in the
previous CERT Advisory, CA-91:02, was incorrect. It was listed as
1001125-02.tar.Z and it should have been 100125-02.tar.Z.  We regret
any inconvenience this may have caused.

<P>Please be aware that the new compressed tarfile provided by Sun
Microsystems, Inc. includes all of the patched files for SunOS 4.0.3,
SunOS 4.1, and SunOS 4.1.1.  That is, the tarfile contains the new
patches for SunOS 4.0.3 as well as those files previously distributed
in the 100125-02.tar.Z tarfile.  The installation of the patch differs
between SunOS 4.0.3 and SunOS 4.1.x.

<P>
<H2>II. Impact </H2>

<P>The vulnerability allows a user on the system to gain unauthorized
access to other accounts, including root.

<P>
<H2>III.  Solution for SunOS 4.0.3 and 4.0.3c</H2>

<P>Sun Microsystems, Inc. has patched versions of in.telnetd and
in.rlogind available for SunOS 4.0.3 on all Sun 3 and Sun 4
architectures.  The Sun Patch ID is 100125-03 which is needed when
ordering the patch from a Sun Answer Center. In the US, telephone
(800) USA-4SUN.  The checksum of the compressed tarfile (filename
100125-03.tar.Z) is 17128 102.  The compressed tarfile is available by
anonymous FTP on uunet.uu.net (192.48.96.2) in
sun-dist/100125-03.tar.Z.  Please note: This compressed tarfile also
includes patched versions of in.telnetd for SunOS 4.1 and 4.1.1.
Please disregard these files.

<P>SunOS 4.0.3 patch installation instructions are as follows:

<PRE>
  # mv /usr/etc/in.telnetd /usr/etc/in.telnetd.FCS
  # mv /usr/etc/in.rlogind /usr/etc/in.rlogind.FCS
  # chmod 600 /usr/etc/in.telnetd.FCS 
  # chmod 600 /usr/etc/in.rlogind.FCS 
</PRE>

<P>(These four steps store the old versions as a precaution and change
the file modes so that the old versions cannot be executed. After
verifying the new versions, the old versions should be removed.)

<PRE>
  # cp sun{3,3x,4,4c}/{4.0.3,4.0.3c}/in.telnetd /usr/etc/in.telnetd
  # cp sun{3,3x,4,4c}/{4.0.3,4.0.3c}/in.rlogind /usr/etc/in.rlogind
</PRE>

<P>(Be sure to copy the appropriate versions for your architecture.)

<PRE>
  # chmod 711 /usr/etc/in.telnetd 
  # chmod 711 /usr/etc/in.rlogind
  # chown root /usr/etc/in.telnetd
  # chown root /usr/etc/in.rlogind
  # chgrp staff /usr/etc/in.telnetd
  # chgrp staff /usr/etc/in.rlogind
  # kill {any executing in.telnetd and in.rlogind process(es) (SEE NOTE)}
</PRE>

<P>NOTE: Be careful in killing existing in.telnetd and in.rlogind
processes, as they may be legitimate users attempting to login to the
system.

<H2>IV.  Solution for SunOS 4.1 and 4.1.1</H2>

<P>Sun Microsystems, Inc. has patched versions of in.telnetd available
for SunOS 4.1 and 4.1.1 on all Sun 3 and Sun 4 architectures.  The Sun
Patch ID is 100125-03 which is needed when ordering the patch from a
Sun Answer Center. In the US, telephone (800) USA-4SUN.  The checksum
of the compressed tarfile (filename 100125-03.tar.Z) is 17128 102.
The compressed tarfile is available by anonymous FTP on uunet.uu.net
(192.48.96.2) in sun-dist/100125-03.tar.Z.  Please note: This tarfile
includes patched versions of in.telnetd and in.rlogind for SunOS
4.0.3.  Please disregard these files.

<P>Patch installation instructions are as follows:

<PRE>
  # mv /usr/etc/in.telnetd /usr/etc/in.telnetd.FCS
  # chmod 600 /usr/etc/in.telnetd.FCS
</PRE>

<P>(These two steps store the old version as a precaution and change
the file mode to that the old version cannot be executed; after
verifying the new version, the old version should be removed.)

<PRE>
# cp sun{3,3x,4,4c}/4.1/in.telnetd /usr/etc/in.telnetd
</PRE>
(Be sure to copy the appropriate version for your architecture.)

<PRE>
  # chmod 711 /usr/etc/in.telnetd
  # chown root /usr/etc/in.telnetd
  # chgrp staff /usr/etc/in.telnetd
  # kill {any executing in.telnetd process(es) (SEE NOTE)}
</PRE>

<P>NOTE: Be careful in killing existing in.telnetd processes, as they
may be legitimate users attempting to login to the system.

<P><HR>

<!--#include virtual="/include/footer_nocopyright.html" -->
<P>Copyright 1991 Carnegie Mellon University.</P>

<HR>

Revision History
<PRE>
September 18,1997  Attached Copyright Statement
</PRE>