InfoMagic Standards 1994 January/InfoMagic Standards - January 1994.iso/inet/scc/9318

Text File | 1993-09-30 | 17KB | 334 lines

**************************************************************************
Security Bulletin 9318                  DISA Defense Communications System
September 30, 1993            Published by: DDN Security Coordination Center
                                      ([e-mail])   1-[phone]

                        DEFENSE  DATA  NETWORK
                          SECURITY  BULLETIN

  The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security
  Coordination Center) under DISA contract as a means of communicating
  information on network and host security exposures, fixes, and concerns
  to security and management personnel at DDN facilities.  Back issues may
  be obtained via FTP (or Kermit) from NIC.DDN.MIL [192.112.36.5]
  using login="anonymous" and password="guest".  The bulletin pathname is
  scc/ddn-security-yynn (where "yy" is the year the bulletin is issued
  and "nn" is a bulletin number, e.g. scc/ddn-security-9302).
**************************************************************************
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
!                                                                       !
!     The following important  advisory was  issued by the Computer     !
!     Emergency Response Team (CERT)  and is being relayed unedited     !
!     via the Defense Information Systems Agency's Security             !
!     Coordination Center  distribution  system  as a  means  of        !
!     providing  DDN subscribers with useful security information.      !
!                                                                       !
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +

Below Incident Advisory is provided by Department of Energy, CIAC Team.

========================================================================

DISTRIBUTION RESTRICTIONS: NONE -- PUBLIC RELEASE

          _____________________________________________________
               The Computer Incident Advisory Capability
                          ___  __ __    _     ___
                         /       |     / \   /
                         \___  __|__  /___\  \___
          _____________________________________________________

                              ADVISORY NOTICE

              Automated Scanning of Network Vulnerabilities

September 30, 1993 1000 PDT                                    Number D-25
__________________________________________________________________________
PROBLEM:   Automated attacks on networked computers.
PLATFORM:  All systems supporting TCP/IP networking.
DAMAGE:    Unauthorized access to information and computer resources.
SOLUTION:  Examine machines for vulnerabilities detailed below and apply
           fixes as needed.
__________________________________________________________________________

     Critical Information about Automated Network Scanning Software

CIAC has learned that software allowing automated scanning of networked
computers for security vulnerabilities was recently made publicly
available on the Internet.  The software package, known as ISS or Internet
Security Scanner, will interrogate all computers within a specified IP
address range, determining the security posture of each with respect to
several common system vulnerabilities.  The software was designed as a
security tool for system and network administrators.  However, given its
wide distribution and ability to scan remote networks, CIAC feels that it
is likely ISS will also be used to locate vulnerable hosts for malicious
reasons.

While none of the vulnerabilities ISS checks for are new, their
aggregation into a widely available automated tool represents a higher
level of threat to networked machines.  CIAC has analyzed the operation of
the program and strongly recommends that administrators take this
opportunity to re-examine systems for the vulnerabilities described below.
Also detailed below are available security tools that may assist in the
detection and prevention of malicious use of ISS.  Finally, common
symptoms of an ISS attack are outlined to allow detection of malicious
use.


ISS Vulnerabilities
-------------------

The following vulnerabilities are tested for by the ISS tool.
Administrators should verify the state of their systems and perform
corrective actions as indicated.

Default Accounts   The accounts "guest" and "bbs", if they exist, should
                   have non-trivial passwords.  If login access to these
                   accounts is not needed, they should be disabled by
                   placing a "*" in the password field and the string
                   "/bin/false" in the shell field in /etc/passwd.  See
                   the system manual entry for "passwd" for more
                   information on changing passwords and disabling
                   accounts.

                   For example, the /etc/passwd entry for a disabled guest
                   account should resemble the following:

                   guest:*:2311:50:Guest User:/home/guest:/bin/false

lp Account         The account "lp", if it exists, should not allow logins.
                   It should be disabled by placing a "*" in the password
                   field and the string "/bin/false" in the shell field in
                   /etc/passwd.

Decode Alias       Mail aliases for decode and uudecode should be disabled
                   on UNIX systems.  If the file /etc/aliases contains
                   entries for these programs, they should be disabled by
                   placing a "#" at the beginning of the line and then
                   executing the command "newaliases".  Consult the manual
                   page for "aliases" for more information on UNIX mail
                   aliases.

                   A disabled decode alias should appear as follows:

                   # decode: "|/usr/bin/uudecode"

Sendmail           The sendmail commands "wiz" and "debug" should be
                   disabled.  This may be verified by executing the
                   following commands:

                   % telnet hostname 25
                   220 host Sendmail 5.65 ready at Wed, 29 Sep 93 20:28:46 PDT
                   wiz
                   You wascal wabbit!  Wandering wizards won't win!
                   (or 500 Command unrecognized)
                   quit

                   % telnet hostname 25
                   220 host Sendmail 5.65 ready at Wed, 29 Sep 93 20:28:46 PDT
                   debug
                   500 Command unrecognized
                   quit

                   If the "wiz" command returns "Please pass, oh mighty
                   wizard", your system is vulnerable to attack.  The
                   command should be disabled by adding a line to the
                   sendmail.cf configuration file containing the string:

                   OW*

                   If the "debug" command responds with the string
                   "200 Debug set", you should immediately obtain a newer
                   version of sendmail software from your vendor.

Anonymous FTP      Anonymous FTP allows users without accounts to have
                   restricted access to certain directories on the system.
                   The availability of anonymous FTP on a given system may
                   be determined by executing the following commands:

                   % ftp hostname
                   Connected to hostname.
                   220 host FTP server ready.
                   Name (localhost:jdoe): anonymous
                   530 User anonymous unknown.
                   Login failed.

                   The above results indicate that anonymous FTP is not
                   enabled.  If the system instead replies with the
                   string "331 Guest login ok" and then prompts for a
                   password, anonymous FTP access is enabled.

                   The configuration of systems allowing anonymous FTP
                   should be checked carefully, as improperly configured
                   FTP servers are frequently attacked.  Refer to CIAC
                   Bulletin D-19 for more information.

NIS                SunOS 4.x machines using NIS are vulnerable unless the
                   patch 100482 has been installed.  See CIAC Bulletin
                   C-25 for more information regarding this patch.

NFS                Filesystems exported under NFS should be mountable only
                   by a restricted set of hosts.  The UNIX "showmount"
                   command will display the filesystems exported by a given
                   host:

                   % /usr/etc/showmount -e hostname
                   export list for hostname:
                   /usr          hosta:hostb:hostc
                   /usr/local    (everyone)

                   The above output indicates that this NFS server is
                   exporting two partitions: /usr, which can be mounted by
                   hosta, hostb, and hostc; and /usr/local which can be
                   mounted by anyone.  In this case, access to the
                   /usr/local partition should be restricted.  Consult the
                   system manual entry for "exports" or "NFS" for more
                   information.

rusers             The UNIX rusers command displays information about
                   accounts currently active on a remote system.  This may
                   provide an attacker with account names or other
                   information useful in mounting an attack.  To check for
                   the availability of rusers information on a particular
                   machine, execute the following command:

                   % rusers -l hostname
                   hostname: RPC: Program not registered

                   If the above example had instead generated a list of
                   user names and login information, a rusers server is
                   running on the host.  The server may be disabled by
                   placing a "#" at the beginning of the appropriate line
                   in the file /etc/inetd.conf and then sending the SIGHUP
                   signal to the inetd process.  For example, a disabled
                   rusers entry might appear as follows:

                   #rusersd/2 dgram rpc/udp wait root /usr/etc/rusersd rusersd

rexd               The UNIX remote execution server rexd provides only
                   minimal authentication and is easily subverted.  It
                   should be disabled by placing a "#" at the beginning of
                   the rexd line in the file /etc/inetd.conf and then
                   sending the SIGHUP signal to the inetd process.  The
                   disabled entry should resemble the following:

                   #rexd/1 stream rpc/tcp wait root /usr/etc/rexd rexd

Available Tools
---------------

There are several available security tools that may be used to prevent or
detect malicious use of ISS.  They include the following:

SPI                SPI, the Security Profile Inspector, will detect the
                   system vulnerabilities described above, as well as many
                   others.  U.S. Government agencies interested in
                   obtaining SPI should send E-mail to [e-mail]
                   or call [phone] for more information.

COPS               The COPS security tool will also detect the
                   vulnerabilities described above.  It is available via
                   anonymous FTP from ftp.cert.org in the directory
                   /pub/tools/cops/1.04.

ISS                Running ISS on your systems will provide you with the
                   same information an attacker would obtain, allowing you
                   to correct vulnerabilities before they can be exploited.
                   Note that the current version of the software is known
                   to function poorly on some operating systems.  If you
                   should have difficulty using the software, please contact
                   CIAC for assistance.  ISS may be obtained via anonymous
                   FTP from ftp.uu.net in the directory
                   /usenet/comp.sources.misc/volume39/iss.

TCP Wrappers       Access to most UNIX network services can be more closely
                   controlled using software known as a TCP wrapper.  The
                   wrapper provides additional access control and flexible
                   logging features that may assist in both the prevention
                   and detection of network attacks.  This software is
                   available via anonymous FTP from ftp.win.tue.nl in the
                   file /pub/security/tcp_wrappers_6.0.shar.Z


Detecting an ISS Attack
-----------------------

Given the wide distribution of the ISS tool, CIAC feels that remote
attacks are likely to occur.  Such attacks can cause system warnings to be
generated that may prove useful in tracking down the source of the attack.
The most probable indicator of an ISS attack is a mail message sent to
"postmaster" on the scanned system similar to the following:

    From: Mailer-Daemon@hostname (Mail Delivery Subsystem)
    Subject: Returned mail: Unable to deliver mail
    Message-Id: <9309291633.AB04591@>
    To: Postmaster@hostname

       ----- Transcript of session follows -----
    <<< VRFY guest
    550 guest... User unknown
    <<< VRFY decode
    550 decode... User unknown
    <<< VRFY bbs
    550 bbs... User unknown
    <<< VRFY lp
    550 lp... User unknown
    <<< VRFY uudecode
    550 uudecode... User unknown
    <<< wiz
    500 Command unrecognized
    <<< debug
    500 Command unrecognized
    421 Lost input channel to remote.machine

       ----- No message was collected -----

If you should receive such a message, it is likely that your machine and
others on your network have been scanned for vulnerabilities.  You should
immediately contact your computer security officer or CIAC for assistance
in assessing the damage and taking corrective action.


For additional information or assistance, please contact CIAC at
[phone] or send E-mail to [e-mail]. FAX messages to
[phone].

PLEASE NOTE: Many users outside of the DOE and ESnet computing communities
receive CIAC bulletins.  If you are not part of these communities, please
contact your agency's response team to report incidents.  Your agency's team
will coordinate with CIAC.  The Forum of Incident Response and Security Teams
(FIRST) is a world-wide organization.  A list of FIRST member organizations
and their constituencies can be obtained by sending email to
[e-mail] with an empty subject line and a message body containing
the line: send first-contacts.

This document was prepared as an account of work sponsored by an agency of
the United States Government.  Neither the United States Government nor the
University of California nor any of their employees, makes any warranty,
expressed or implied, or assumes any legal liability or responsibility for
the accuracy, completeness, or usefulness of any information, product, or
process disclosed, or represents that its use would not infringe privately
owned rights.  Reference herein to any specific commercial products, process,
or service by trade name, trademark manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation, or favoring
by the United States Government or the University of California.  The views
and opinions of authors expressed herein do not necessarily state or reflect
those of the United States Government nor the University of California, and
shall not be used for advertising or product endorsement purposes.


****************************************************************************
*                                                                          *
*    The point of contact for MILNET security-related incidents is the     *
*    Security Coordination Center (SCC).                                   *
*                                                                          *
*               E-mail address: [e-mail]                            *
*                                                                          *
*               Telephone: [phone]                                *
*                                                                          *
*    NIC Help Desk personnel are available from 7:00 a.m.-7:00 p.m. EST,   *
*    Monday through Friday except on federal holidays.                     *
*                                                                          *
****************************************************************************