CERT contact

[jdassen@wi.leidenuniv.nl (J.H.M.Dassen)]

Also, www.debian.org/security.html gives security@bugs.debian.org as contact
address. Shouldn't this be without the 'bugs.'?

Ray
-- 
POPULATION EXPLOSION  Unique in human experience, an event which happened 
yesterday but which everyone swears won't happen until tomorrow.  
- The Hipcrime Vocab by Chad C. Mulligan

--- Begin Message ---

• To: jdassen@wi.leidenuniv.nl
• Subject: failure notice
• From: MAILER-DAEMON@debian.novare.net
• Date: 4 Apr 1997 13:49:49 -0000

Hi. This is the qmail-send program at debian.novare.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<debian-security@lists.debian.org>:
Your message was addressed incorrectly. Here is a list of all of the
valid addresses in the lists.debian.org domain:
	listmaster: A human being, not a machine, your last resort.
	debian-68k: Mailing list.
	debian-68k-REQUEST: request server for mailing list.
	debian-admintool: Mailing list.
	debian-admintool-REQUEST: request server for mailing list.
	debian-alpha: Mailing list.
	debian-alpha-REQUEST: request server for mailing list.
	debian-announce: Mailing list.
	debian-announce-REQUEST: request server for mailing list.
	debian-bugs-dist: Mailing list.
	debian-bugs-dist-REQUEST: request server for mailing list.
	debian-changes-digest: Mailing list.
	debian-changes-digest-REQUEST: request server for mailing list.
	debian-changes: Mailing list.
	debian-changes-REQUEST: request server for mailing list.
	debian-devel-announce: Mailing list.
	debian-devel-announce-REQUEST: request server for mailing list.
	debian-devel-changes: Mailing list.
	debian-devel-changes-REQUEST: request server for mailing list.
	debian-devel-digest: Mailing list.
	debian-devel-digest-REQUEST: request server for mailing list.
	debian-devel: Mailing list.
	debian-devel-REQUEST: request server for mailing list.
	debian-doc: Mailing list.
	debian-doc-REQUEST: request server for mailing list.
	debian-faq: Mailing list.
	debian-faq-REQUEST: request server for mailing list.
	debian-french: Mailing list.
	debian-french-REQUEST: request server for mailing list.
	debian-i18n: Mailing list.
	debian-i18n-REQUEST: request server for mailing list.
	debian-l10n-spanish: Mailing list.
	debian-l10n-spanish-REQUEST: request server for mailing list.
	debian-publicity: Mailing list.
	debian-publicity-REQUEST: request server for mailing list.
	debian-qa: Mailing list.
	debian-qa-REQUEST: request server for mailing list.
	debian-sparc: Mailing list.
	debian-sparc-REQUEST: request server for mailing list.
	debian-testing: Mailing list.
	debian-testing-REQUEST: request server for mailing list.
	debian-user-digest: Mailing list.
	debian-user-digest-REQUEST: request server for mailing list.
	debian-user: Mailing list.
	debian-user-REQUEST: request server for mailing list.
	test: Mailing list.
	test-REQUEST: request server for mailing list.

--- Below this line is a copy of the message.

Return-Path: <jdassen@wi.leidenuniv.nl>
Received: (qmail 7095 invoked from network); 4 Apr 1997 13:49:47 -0000
Received: from zeus.wi.leidenuniv.nl (HELO mailhost.wi.leidenuniv.nl) (root@132.229.128.1)
  by debian.novare.net with SMTP; 4 Apr 1997 13:49:47 -0000
Received: from hermes.wi.leidenuniv.nl (jdassen@hermes [132.229.128.3])
          by mailhost.wi.leidenuniv.nl (8.6.10a/SBH-1.20.1-M) with ESMTP id PAA11119
          for <debian-security@lists.debian.org>;  Fri, 4 Apr 1997 15:51:42 +0200 (MET)
From: jdassen@wi.leidenuniv.nl (J.H.M.Dassen)
Organization: Leiden University,
              Dept. of Mathematics & Computer Science,
              The Netherlands
Received: from  (jdassen@localhost)
          by hermes.wi.leidenuniv.nl (8.6.10a/FHM-1.01-S) id PAA00583
          Fri, 4 Apr 1997 15:48:32 +0200 (MET)
Date: Fri, 4 Apr 1997 15:48:32 +0200
Message-Id: <199704041348.PAA00583@hermes.wi.leidenuniv.nl>
To: debian-security@lists.debian.org
Subject: Fwd: CERT Advisory CA-97.08 - Second vulnerability related to INN - ucbmail

I've not seen anything relating to this on debian-security. Does anyone know
what contact CERT is using for Debian? Shouldn't they be using
security@debian.org ?

Greetings,
Ray

--- begin article ---
Path: nic.wi.leidenuniv.nl!highway.leidenuniv.nl!surfnet.nl!howland.erols.net!vi
 xen.cso.uiuc.edu!news-peer.sprintlink.net!news.maxwell.syr.edu!news.cis.ohio-st
 ate.edu!nntp.sei.cmu.edu!news.sei.cmu.edu!cert-advisory
From: CERT Advisory <cert-advisory@cert.org>
Newsgroups: comp.security.announce
Subject: CERT Advisory CA-97.08 - Second vulnerability related to INN - ucbmail
Date: 3 Apr 1997 21:25:40 GMT
Organization: CERT(sm) Coordination Center -  +1 412-268-7090
Lines: 431
Distribution: world
Message-ID: <5i178k$18v@news.sei.cmu.edu>
Reply-To: cert-advisory-request@cert.org
NNTP-Posting-Host: coal.cert.org
Keywords: security CERT
Originator: cert-advisory@cert.org
Originator: cert-advisory@coal.cert.org

-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
CERT* Advisory CA-97.08
Original issue date: February 20, 1997
Last revised: April 3, 1997
              Added information on a second vulnerability (labeled Topic 2),
              including a new patch that must be applied to many versions of
              INN. Labeled vendor information as input on Topic 1 or 2. 

              A complete revision history is at the end of this file.

Topic 2: Second vulnerability related to INN - ucbmail
Topic 1: Vulnerability in innd
- -----------------------------------------------------------------------------

A second vulnerability was found in INN (InterNetNews server) after the
initial publication of this advisory. We are including it in this advisory as
"Topic 2" so that all INN information is in one advisory. Versions 1.5.1 and
earlier are vulnerable to this second problem.

Information about the first vulnerability has been widely distributed, and we
have received numerous reports of exploitation. INN 1.5 and earlier are
vulnerable to this problem.

Both vulnerabilities allow unauthorized users to execute arbitrary commands on
the machine running INN by sending a maliciously formed news control message.
Because the problem is with the content of news control messages, attacks can
be launched remotely and may reach news servers located behind Internet
firewalls.

The CERT/CC staff recommends that sites upgrade to INN 1.5.1 and add the patch
described in Section III.A. Until you can upgrade, you should apply two
patches, as described in Section III.B. You may also want to check with your
vendor. Vendors who have provided input for this advisory are listed in
Sec. III.C and Appendix A.

We will update this advisory as we receive additional information.
Please check advisory files regularly for updates that relate to your site.

- -----------------------------------------------------------------------------

I.  Description 

    Topic 2 - ucbmail 
    ----------------- 

     A second vulnerability involving INN has been found. It is similar to
     *but not the same as* the one described in Topic 1 below.

    INN itself attempts to carefully remove certain shell "metacharacters"
    from data in control messages before passing that data to a shell. The
    patch for Topic 1 fixes some of the checks that were found to be
    inadequate. However ucbmail, a program typically configured as the mailer
    INN should use, lacks similar checks. INN passes some data unchecked to
    this mailer, which in turn passes the data to a shell for processing.

    James Brister, the current maintainer of INN, has made a patch available
    that checks more data before it is passed to the mailer program. Although
    only the ucbmail program is known to have this problem, sites are
    encouraged to apply the patch regardless of what mail program their INN is
    configured to use.


    Topic 1 - Information provided with the initial advisory 
    ---------------------------------------------------------
    The INN daemon (innd) processes "newgroup" and "rmgroup" control messages
    in a shell script (parsecontrol) that uses the shell's "eval" command.
    However, some of the information passed to eval comes from the message
    without adequate checks for characters that are special to the shell.

    This permits anyone who can send messages to an INN server - almost anyone
    with Usenet access - to execute arbitrary commands on that server. These
    commands run with the uid and privileges of the "innd" process on that
    server. Because such messages are usually passed through Internet
    firewalls to a site's news server, servers behind such firewalls are
    vulnerable to attack. Also, the program executes these commands before
    checking whether the sender is authorized to create or remove newsgroups,
    so checks at that level (such as running pgpverify) do not prevent this
    problem.

    As of the advisory update of March 18, 1997, we have received numerous
    reports that the vulnerability is being exploited.

    Determining if you are vulnerable 
    --------------------------------- 
    You can determine which version of INN your site is running by connecting
    to the NNTP port (119) of your news server. For example:

          % telnet news.your.site 119
          Connected to news.your.site
          Escape character is '^]'.
          200 news.your.site InterNetNews server INN 1.4unoff4 05-Mar-96 ready

    Type "quit" to exit the connection. Note that this does not indicate
    whether or not the patch recommended below has been installed.
  

II. Impact
   
    (applies to both topics 1 & 2)
   
    Remote, unauthorized users can execute arbitrary commands on the
    system with the same privileges as the innd (INN daemon) process.
    Attacks may reach news servers located behind Internet firewalls.


III. Solution

     Warning: If you applied any of the solutions offered in the version of
              this advisory released on Feb. 20, 1997, you must add an
              additional patch. 

     (The following recommendations apply to both topics 1 & 2.)

     We recommend upgrading to version 1.5.1 and applying the patch developed
     by James Brister, the current maintainer of INN (Section III. A). If you
     upgraded previously, you must apply this new patch to protect against the
     second vulnerability. Until you can upgrade, you need to apply two
     patches (Section III. B). You may also want to consult your vendor.
     Vendors who have provided input for this advisory are listed in 
     Sec. III.C and Appendix A.

     After installing any of the patches or updates, ensure that you
     restart your INN server.


     A. Upgrade to INN 1.5.1 and apply a patch.

        The current version of INN is 1.5.1. It is not vulnerable to the first
        vulnerability; but it is vulnerable to the second, so a patch is
        necessary. 

        When you upgrade to INN 1.5.1, please be sure to read the README file
        carefully.

        INN 1.5.1 and information about it are available from

                http://www.isc.org/inn.html

        The md5 checksum for the gzip'ed tar file is
                MD5 (inn-1.5.1.tar.gz) = 555d50c42ba08ece16c6cdfa392e0ca4

        The patch is available from
                ftp://ftp.isc.org:/isc/inn/patches/security-patch.04

        Checksums for patches are in the directory, along with a README.


     B. If you do not upgrade to 1.5.1, apply a patch for the version you are
        running and then apply the newly released patch that addresses the
        second vulnerability discussed in this advisory. If you are running
        INN 1.4sec2, you should upgrade to 1.5.1 as no patches are available.

   FIRST apply:
   version               patch
   -------               -----
    1.5                   ftp://ftp.isc.org/isc/inn/patches/security-patch.01
    1.4sec                ftp://ftp.isc.org/isc/inn/patches/security-patch.02
    1.4unoff3, 1.4unoff4  ftp://ftp.isc.org/isc/inn/patches/security-patch.03


   THEN apply (1.5.1, 1.5, 1.4sec, 1.4unoff3, 1.4unoff4)
                          ftp://ftp.isc.org:/isc/inn/patches/security-patch.04
                 
    There are md5 checksums for each file in the directory, and a README file
    describes what is what.


     C. Consult your vendor

        Below is a list of vendors who have provided information about INN.
        Details are in Appendix A of this advisory; we will update the
        appendix as we receive more information. If your vendor's name is not
        on this list, the CERT/CC did not hear from that vendor. Please
        contact your vendor directly.

           Berkeley Software Design, Inc. (BSDI)
           Caldera
           Cray Research - A Silicon Graphics Company
           Debian Linux
           NEC Corporation
           Netscape
           Red Hat Linux
        

...........................................................................

Appendix A - Vendor Information

Below is a list of the vendors who have provided information for this
advisory, along with an indication about whether the information relates to
the first vulnerability or both. We will update this appendix as we receive
additional information.  If you do not see your vendor's name, the CERT/CC did
not hear from that vendor. Please contact the vendor directly.


Berkeley Software Design, Inc. (BSDI)
====================================
For Topic 1
        We ship INN as part of our distribution.  BSD/OS 2.1 includes INN
        1.4sec and 2.1 users should apply the patch referenced in the
        advisory.  BSD/OS 3.0 includes INN 1.4unoff4 and the patch for that
        version is already included so BSD/OS 3.0 is not vulnerable as
        distributed.


Caldera
=======
For Topic 1
        An upgrade package for Caldera OpenLinux Base 1.0 will appear at
        Caldera's site:

ftp://ftp.caldera.com/pub/col-1.0/updates/Helsinki/004/inn-1.5.1-2.i386.rpm

        MD5 sum is:

        3bcd3120b93f41577d3246f3e9276098  inn-1.5.1-2.i386.rpm


Cray Research - A Silicon Graphics Company
==========================================
For Topics 1 and 2
        Cray Research has never shipped any news server with Unicos.


Debian Linux
============
For Topic 1
        The current version of INN shipped with Debian is 1.4unoff4. However
        the "unstable" (or development) tree contains inn-1.5.1. It can be
        gotten from any debian mirror in the subdirectory

        debian/unstable/binary/news

d3603d9617fbf894a3743a330544b62e 591154 news optional inn_1.5.1-1_i386.deb
205850779d2820f03f2438d063e1dc51 45230 news optional inn-dev_1.5.1-1_i386.deb
badbe8431479427a4a4de8ebd6e1e150 31682 news optional inewsinn_1.5.1-1_i386.deb


NEC Corporation
===============
For Topics 1 and 2
         Products below are shipped with INN mentioned in this advisory,
         so they are vulnerable and patches are in progress.

         Goah/NetworkSV R1.2     vulnerable
         Goah/NetworkSV R2.2     vulnerable
         Goah/NetworkSV R3.1     vulnerable
         Goah/IntraSV R1.1       vulnerable


Netscape
========
For Topic 1 
     The Netscape News Server 2.01 is immune to the attack outlined in the
     advisory.

     The News Server 1.1 is, however, subject to the same vulnerability as INN
     and we have advised customers to install the patch described in the
     advisory.


Red Hat Linux
=============
For Topics 1 and 2
There is a critical security hole in INN which affects all versions of Red Hat
Linux. A new version, inn-1.5.1-6, is now available for Red Hat Linux 4.0 and
4.1 for all platforms. If you are running an earlier version of Red Hat, we
strongly encourage you to upgrade to 4.1 as soon as possible, as many critical
security fixes have been made. The new version of inn is PGP signed with the
Red Hat PGP key, which is available on all Red Hat CDROMs, ftp.redhat.com, and
public keyservers.

You may upgrade to the new version as follows:

Red Hat 4.1
- -----------

i386:
rpm -Uvh ftp://ftp.redhat.com/updates/4.1/i386/inn-1.5.1-6.i386.rpm

alpha:
rpm -Uvh ftp://ftp.redhat.com/updates/4.1/alpha/inn-1.5.1-6.alpha.rpm

SPARC:
rpm -Uvh ftp://ftp.redhat.com/updates/4.1/sparc/inn-1.5.1-6.sparc.rpm

Red Hat 4.0
- -----------

i386:
rpm -Uvh ftp://ftp.redhat.com/updates/4.0/i386/inn-1.5.1-6.i386.rpm

alpha:
rpm -Uvh ftp://ftp.redhat.com/updates/4.0/alpha/inn-1.5.1-6.alpha.rpm

SPARC:
rpm -Uvh ftp://ftp.redhat.com/updates/4.0/sparc/inn-1..5.1-6.sparc.rpm


- -----------------------------------------------------------------------------
The CERT Coordination Center thanks James Brister of the Internet Software
Consortium for making fixes available and Matt Power of MIT for
analyzing and reporting the first problem. We also thank AUSCERT for their
contributions to this advisory. James Crawford Ralston of the University of
Pittsburgh and Frank Miller of Tektronix Corporation assisted with the
March 18, 1997 update. 

The second vulnerability addressed in this advisory was discovered by security
experts in the Global Security Analysis Laboratory (GSAL) at IBM's
T.J. Watson Research Center. We thank the IBM Emergency Response Service for
providing information on this topic. (They published information in
ERS-SVA-E01-1997:002.1. Their alert is copyrighted 1997 by International
Business Machines Corporation.)

- -----------------------------------------------------------------------------

If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (see ftp://info.cert.org/pub/FIRST/team-info).


CERT/CC Contact Information
- ----------------------------
Email    cert@cert.org

Phone    +1 412-268-7090 (24-hour hotline)
                CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
                and are on call for emergencies during other hours.

Fax      +1 412-268-6989

Postal address
         CERT Coordination Center
         Software Engineering Institute
         Carnegie Mellon University
         Pittsburgh PA 15213-3890
         USA

Using encryption
   We strongly urge you to encrypt sensitive information sent by email. We can
   support a shared DES key or PGP. Contact the CERT/CC for more information.
   Location of CERT PGP key
         ftp://info.cert.org/pub/CERT_PGP.key

Getting security information
   CERT publications and other security information are available from
        http://www.cert.org/
        ftp://info.cert.org/pub/

   CERT advisories and bulletins are also posted on the USENET newsgroup
        comp.security.announce

   To be added to our mailing list for advisories and bulletins, send
   email to
        cert-advisory-request@cert.org
   In the subject line, type
        SUBSCRIBE  your-email-address

- ---------------------------------------------------------------------------
Copyright 1997 Carnegie Mellon University
This material may be reproduced and distributed without permission provided
it is used for noncommercial purposes and the copyright statement is
included.

* Registered U.S. Patent and Trademark Office. 
- ---------------------------------------------------------------------------

This file: ftp://info.cert.org/pub/cert_advisories/CA-97.08.innd
           http://www.cert.org
               click on "CERT Advisories"

==============================================================================
UPDATES

March 18, 1997
- --------------
If you are upgrading to INN 1.5.1, please be sure to read the README file
carefully. Note that if you are upgrading to 1.5.1 from a previous release,
running a "make update" alone is not sufficient to ensure that all of the
vulnerable scripts are replaced (e.g., parsecontrol). Please especially note
the following from the INN 1.5.1 distribution README file:

        When updating from a previous release, you will usually want
        to do "make update" from the top-level directory; this will
        only install the programs.  To update your scripts and config
        files, cd into the "site" directory and do "make clean" --
        this will remove any files that are unchanged from the
        official release.  Then do "make diff >diff"; this will show
        you what changes you will have to merge in.  Now merge in your
        changes (from where the files are, ie. /usr/lib/news...) into
        the files in $INN/site.  (You may find that due to the bug
        fixes and new features in this release, you may not need to
        change any of the scripts, just the configuration files).
        Finally, doing "make install" will install everything.

After installing any of the patches or updates, ensure that you
restart your INN server.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision history

Apr 03, 1997  Added information on a second vulnerability (labeled Topic 2),
              including a new patch that must be applied to many versions of
              INN. Labeled vendor information as input on Topic 1 or 2. 

Mar 25, 1997  Section III.B - added a note that no patches are available for
                              version 1.4sec2.
Mar 24, 1997  Appendix A - added information from Netscape.
Mar 21, 1997  Appendix A - added information from NEC Corporation.
Mar 18, 1997  Updates section - added a caution for sites upgrading to 1.5.1
              Acknowledgments - added J. C. Ralston and F. Miller

Mar 17, 1997   Section III.B - corrected patch information (patch.03 must be
               used for 1.4unoff3, 1.4unoff4 rather than patch.01); added a
               URL for INN information.

               Section III.A and introduction - noted that the vulnerability
               is being actively exploited.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM0QRmHVP+x0t4w7BAQGVMAQAhhrRuf1a2yD70ODqzETXuyQpjaFKIkA3
xMm7wc/KIyc8bOA0CHDNIRg4XVDgx2L0GkUObYbPeoROkSEQ97ykn1/jTBBALoGZ
0bHb6Mi0p4a5wPvFqss6Mtm6EhRl9sKf3lIrvZyPRo3p6AsNRldp5SU4hKPG4GMu
ll7CS4+c+oE=
=9AuE
-----END PGP SIGNATURE-----
---end article---

--- End Message ---