CERT Advisory 034

eZine lover (@eZine)

Published in 

CERT Advisory

 · 4 years ago

  

 
-----BEGIN PGP SIGNED MESSAGE----- 

=========================================================================== 
CA-91:19                        CERT Advisory 
                              October 17, 1991 
                        AIX TFTP Daemon Vulnerability 

- --------------------------------------------------------------------------- 

The Computer Emergency Response Team/Coordination Center (CERT/CC) has 
received information concerning a vulnerability in the TFTP daemon in 
all versions of AIX for IBM RS/6000 machines. 

IBM is aware of this problem and a fix is available as apar number "ix22628". 
This patch is available for all AIX releases from "GOLD" to the current 
release. 

NOTE: THIS IS AN UPDATED PATCH FROM ONE RECENTLY MADE AVAILABLE and fixes 
a security hole in the original patch.  The SCCS id of the correct patch 
is tftpd.c 1.13.1.3 (*not* 1.13.1.2 or earlier versions).  This can be  
checked using the following "what" command. 

    % what /etc/tftpd 
    /etc/tftpd: 
       56      1.13.1.3  tftpd.c, tcpip, tcpip312 10/10/91 09:01:48 
       tftpsubs.c      1.2  com/sockcmd/tftpd,3.1.2,9048312 10/8/89 17:40:55 

IBM customers may call IBM Support (800-237-5511) and ask that the fix 
be shipped to them.  The fix will appear in the upcoming 2009 update 
and the next release of AIX. 

- --------------------------------------------------------------------------- 

I.   Description 

     Previous versions of tftpd did not provide a method for restricting  
     TFTP access. 

II.  Impact 

     If TFTP is enabled at your site, anyone on the Internet can retrieve 
     copies of your site's world-readable files, such as /etc/passwd. 

III. Solution 
         
     A. Sites that do not need to allow tftp access should disable it. 
	This can be done by editing /etc/inetd.conf and deleting or 
	commenting out the tftpd line: 

	#tftp     dgram     udp    wait    nobody  /etc/tftpd     tftpd -n 

	and then, as root, restarting inetd with the "refresh" command. 

	    # refresh -s inetd 

	For more details on starting/stopping tftp, refer to documentation 
	for the System Resource Controller (SRC) or the System Management 
	Interface Tool (SMIT). 

     B. Sites that must run tftpd (for example, to support X terminals) 
	should obtain and install the above patch AND create a 
	/etc/tftpaccess.ctl file to restrict the files that are accessible. 
        The /etc/tftpaccess.ctl file should be writable only by root. 
	Although the new /etc/tftpaccess.ctl mechanism provides a very general 
	capability, the CERT/CC strongly recommends that sites keep this 
	control file simple.  For example, the following tftpaccess.ctl file 
	is all that is necessary to support IBM X terminals: 

	# /etc/tftpaccess.ctl 
	# By default, all files are restricted if /etc/tftpaccess.ctl exists. 
	# Allow access to X terminal files. 
	allow:/usr/lpp/x_st_mgr/bin 

	NOTE: Be CERTAIN to create the /etc/tftpaccess.ctl file. 
	If it does not exist then all world-readable files are accessible 
	as in the current version of tftpd. 

        Installation Instructions: 

        1.  Create an appropriate /etc/tftpaccess.ctl file. 

        2.  From the directory containing the new tftpd module, issue 
            the following commands as root. 
         
            # chmod 644 /etc/tftpaccess.ctl 
            # chown root.system /etc/tftpaccess.ctl 
	    # mv /etc/tftpd /etc/tftpd.old 
	    # cp tftpd /etc 
	    # chmod 755 /etc/tftpd 
	    # chown root.system /etc/tftpd 
	    # refresh -s inetd 

- --------------------------------------------------------------------------- 
The CERT/CC wishes to thank Karl Swartz of the Stanford Linear Accelerator 
Center for bringing this vulnerability to our attention. 
- --------------------------------------------------------------------------- 

If you believe that your system has been compromised, contact CERT/CC via 
telephone or e-mail. 

Computer Emergency Response Team/Coordination Center (CERT/CC) 
Software Engineering Institute 
Carnegie Mellon University 
Pittsburgh, PA 15213-3890 

Internet E-mail: cert@cert.org 
Telephone: 412-268-7090 24-hour hotline: 
           CERT/CC personnel answer 7:30a.m.-6:00p.m. EST/EDT, 
           on call for emergencies during other hours. 

Past advisories and other computer security related information are available 
for anonymous ftp from the cert.org (192.88.209.5) system. 

 
-----BEGIN PGP SIGNATURE----- 
Version: 2.6.2 

iQCVAwUBMaMwznVP+x0t4w7BAQERFgP/bGMGTnf/Kkcd80VfEyzDm1LpJcskHDin 
W+OqqbUrX/SZ1CNpjh/Yp395fZy4jAZKzVzYxIKhML0XHdAGYWsSBKQmZUhW6fkB 
sXKlbi2P0jFqVzfMuIuzuT+3p+6REm432PNOpJVndrd361SdgS6qtlmLjmwt0dCU 
e5JKsJUtjcU= 
=yuEL 
-----END PGP SIGNATURE-----