%ca9122f
CERT Advisory CA-91:22

The `loadmodule' executable from OpenWindows 3.0 contains a security
vulnerability that can allow a local user to gain root access.

Sun Patch 100448-01 provides a fix for this.
%ca9122w
CERT Advisory CA-91:22

The `loadmodule' executable installed on this machine may contain a
security vulnerability that can allow a local user to gain root
access.  This applies to OpenWindows 3.0.

Sun Patch 100448-01 provides a fix for this.
%ca9122i
The OpenWindows binary `loadmodule' could not be located in order
to check it for vulnerabilities.  If you have OpenWindows 3.0 installed,
then you should set the environment variable OPENWINHOME to point to
the OpenWindows installation directory and rerun the security checking
system.  For example:

setenv OPENWINHOME /usr/local/openwin

./tiger

Other versions of OpenWindows do not exhibit this vulnerability.

See message-id ca9122f for information on the vulnerability.
%misc001w
If the console on a Sun workstation is marked as secured, then it is
possible for someone with physical access to the console to
reboot the machine in single-user mode, thus giving them root
access to the machine.  This can be corrected by editing the
file /etc/ttytab and removing the word 'secure' from the
entry for the console.  By doing this, the root password must
be entered when booting in single-user mode.  Thus, if you forget
the root password, you will have to boot from some other media
in order to get back in.  This will *also* prevent root logins
on the console.  It will be necessary to login as a normal user,
then 'su' to the root account (this is a preferred method as it
provides accountability).

If your system's console is in a physically secure location, then
it is fairly safe to leave this as it is.
%misc002w
If the tty's and pseudo-tty's on a Sun workstation are marked
as secured, then it is possible to login as 'root' on any of
these tty's.  This does not provide any accountability as
to who is using the 'root' account.  This can be corrected by
editing the file /etc/ttytab and removing the word 'secure' from
the tty and pseudo-tty lines.  By doing this, it will not be
possible to login directly as 'root' via telnet, rlogin, or on
a hardwired terminal.  It will be necessary to login as a normal
user, then 'su' to the root account, thereby providing accountability.
%misc003f
Without the /var/yp/securenets file, an NIS server will hand out
its map files to any client that asks.  Since the password file
is one of the maps maintained by the NIS server, anyone on the
Internet is capable of retrieving your password file.  The `securenets'
file allows you to specify networks and hosts which are allowed to
retrieve information from the server.

This requires that Sun Patch ID 100482 be installed.
%misc004w
If the PROM monitor is not in secure mode, then someone with
physical access to the console can enter the PROM monitor and
execute commands which allow them to read and modify memory, boot
alternate OS's etc.  See the 'eeprom' man page for information
on securing the PROM monitor.
%misc005e
The listed security check file from a check.d/ file does not
exist.
%misc006w
The NFS mount daemon is running with port checking disabled.
This means that any user on an authorized client can obtain
a file handle for an exported file-system.  If port checking
is also disabled in the kernel, this file handle can be used
to gain unauthorized access to files, and possibly to gain
unauthorized privileges.  On SunOS 4.x machines, the '-n'
switch is used to disable port checking.  This is the default
when C2 security is not enabled.  Port checking can be enabled
by editing the /etc/rc.local file and removing the '-n' switch
from the rpc.mountd command.

NOTE:  Doing this may break certain older NFS implementations which
do not use a privileged port.  You should verify that any clients
do not have this problem.
%misc007w
The `ypbind' on this machine is running with a `ypset' option (either
-ypset or -ypsetme).  These options can allow an intruder to redirect
NIS lookups to a server set up by them, allowing them to gain privileged
access.  These options should not be used.
%misc008w
The running kernel is not checking to see if the source
port for NFS requests is a privileged port.  If the machine
is not doing NFS serving, this is not a problem.  If it is,
this means that any user on an authorized client that can obtain
a file handle for an exported file-system can gain unauthorized
access to files, and possibly gain unauthorized privileges.
If port checking is also disabled for the NFS mount daemon [misc006w],
this becomes very easy to do.  To enable port checking, the
kernel variable 'nfs_portmon' should be set to a non-zero value.

On SunOS 4.x systems, an 'adb' command exists in the /etc/rc.local
script to set this variable during boot up.  This command is normally
only executed for systems which have enabled Sun's C2 security.
Removing the command from the surrounding 'if' block will enable it
for non-C2 systems.

For SunOS 5.x systems, add the line

set nfs:nfs_portmon = 1

to the /etc/system file and reboot.

NOTE: Enabling NFS port checking may break certain older NFS
implementations which do not use a privileged port.  You should verify
that any clients do not have this problem.
%misc009w
The -hosts option is being used with the automounter.  This may
allow unauthorized access or privileges to be gained.  The -hosts
option allows filesystems to be automounted from any host on
the network.  If the machine is attached to the Internet, any
host on the Internet is a candidate.
%ca9302a
CERT Advisory CA-93:02a

A vulnerability exists in the distributed printing facility of all
releases of NeXTSTEP software though NeXTSTEP 3.0.  The "_writers"
property on the "/printers" and "/fax_modems" should be removed.

See the CERT advisory for more details.
%misc010w
CERT Advisory CA-93:15

CERT Advisory CA-93:16

A serious vulnerability exists in most versions of sendmail
distributed prior to late October, or early November 1993.  This
vulnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability affects the final destination host, therefore
firewalled machines are vulnerable.  The CERT advisory CA-93:16
provides three approaches for the problem.  If feasible, the
b /uslnerability allows remote users to execute arbitrary programs.
The vulnerability af