FedCIRC Advisory FA-99-13 August 31, 1999 Each quarter, the CERTŪ Coordination Center (CERT/CC) issues the CERT summary to draw attention to the types of attacks reported to our incident response team, as well as other noteworthy incident and vulnerability information. The summary includes pointers to sources of information for dealing with the problems. Past CERT summaries are available from [1]http://www.cert.org/summaries/ ______________________________________________________________________ New CERT/CC PGP Key On October 4, 1999, the current PGP key for the CERT/CC will be replaced with a new PGP key. For more information, see [2]http://www.cert.org/pgp/newpgp.html ______________________________________________________________________ New "CERT/CC Current Activity" Web Page The CERT/CC Current Activity web page is a regularly updated summary of the most frequent, high-impact types of security incidents and vulnerabilities currently being reported to the CERT/CC. It is available from [3]http://www.cert.org/current/current_activity.html The information on the Current Activity page will be reviewed and updated as reporting trends change. ______________________________________________________________________ Recent Activity Since the last CERT summary, issued in May 1999 ([4]CS-99-02), we have noted several vulnerabilities in RPC services, and we have analyzed and published information regarding the ExploreZip worm. We also continue to see widespread scans for known vulnerabilites. Protect your systems. Use current software versions, install patches as they become available, and update your scanning tools and anti-virus software with the latest virus signatures or definitions. Be cautious of unsolicited documents or executable programs received in electronic mail. Be wary of software that comes from untrusted sources. 1. RPC Vulnerabilities We have received many reports of exploitations involving three RPC vulnerabilties. Such exploitations can lead to root compromise on systems that implement these RPC services. Analysis has shown that similar artifacts have been found on compromised systems. The vulnerable services are rpc.cmsd Remote and local users can execute arbitrary code with the privileges of the rpc.cmsd daemon, typically root. This vulnerability is being exploited in a significant number of incidents reported to the CERT/CC. For more information see CERT Incident Note 99-04 [5]http://www.cert.org/incident_notes/IN-99-04.html CERT Advisory CA-99-08 [6]http://www.cert.org/advisories/CA-99-08-cmsd.html statd and automoutd Vulnerabilities in these two services are being used together by intruders to gain access to vulnerable systems. The first vulnerability is in rpc.statd, a program used to communicate state changes among NFS clients and servers. The second vulnerability is in automountd, a program used to automatically mount certain types of file systems. The vulnerability in rpc.statd may allow a remote intruder to call arbitrary RPC services with the privileges of the rpc.statd process, typically root. The vulnerablility in automountd may allow a local intruder to execute arbitrary commands with the privileges of the automountd service. By combining attacks exploiting these two vulnerabilities, a remote intruder is able to execute arbitrary commands with the privileges of the automountd service. For more information see CERT Incident Note 99-04 [7]http://www.cert.org/incident_notes/IN-99-04.html CERT Advisory CA-99-05 [8]http://www.cert.org/advisories/CA-99-05-statd-automountd.h tml ttbserverd The ToolTalk database server (rpc.ttdbserverd) is an ONC RPC service that manages objects needed for the operation of the ToolTalk service. ToolTalk-enabled processes communicate with each other using RPC calls to this program, which runs on each ToolTalk-enabled host. This program is a standard component of CDE (Common Desktop Environment), which is a standard component of many commercial Unix operating systems. Due to an implementation fault in rpc.ttdbserverd, it is possible for a malicious remote client to formulate an RPC message that can lead to a buffer overflow. This buffer overflow can result in an attacker gaining total control of the ttdbserver process. An intruder may be able to use this control to gain root-level privileges. CERT Incident Note 99-04 [9]http://www.cert.org/incident_notes/IN-99-04.html CERT Advisory CA-98-11 [10]http://www.cert.org/advisories/CA-98.11.tooltalk.html 2. Virus and Trojan Horse Activity We continue to see reports of virus activity. Current versions of anti-virus software can help to protect your systems from these viruses. It is important to take great caution with any email or Usenet attachments that contain executable content. If you receive a message containing attachments, scan the message file with anti-virus software before you open or run the file. Doing this does not guarantee that the contents of the file are safe, but it lowers your risk of virus infection by checking for viruses and Trojan horses that your scanning software can detect. ExploreZip.exe The ExploreZip program is a Trojan horse affecting Windows 95/98/NT systems. It modifies system files and destroys files. For ExploreZip to work, a person must open or run an infected email attachment, which allows the program to install a copy of itself on the victim's computer and enables further propagation. ExploreZip may also behave as a worm, propagating to other network machines without human interaction. For more information see CERT Advisory CA-99-06 ExploreZip Trojan Horse Program [11]http://www.cert.org/advisories/CA-99-06-explorezip.html CERT Advisory CA-99-02 Trojan Horses [12]http://www.cert.org/advisories/CA-99-02-Trojan-Horses.htm l 3. Continued Widespread Scans We are still receiving daily reports of intruders using tools to scan networks for multiple vulnerabilities. Intruder scanning tools continue to become more sophisticated, varying from scripted tools and stealth scanning techniques to a tool that incorporates probes for known vulnerabilities, remote operating system identification, and automated exploitation attempts. For more information, see "sscan" Scanning Tool [13]http://www.cert.org/incident_notes/IN-99-01.html Automated Scanning and Exploitation [14]http://www.cert.org/incident_notes/IN-98-06.html Probes with Spoofed IP Addresses [15]http://www.cert.org/incident_notes/IN-98-05.html Advanced Scanning [16]http://www.cert.org/incident_notes/IN-98.04.html New Tools Used for Widespread Scans [17]http://www.cert.org/incident_notes/IN-98.02.html The most frequent reports involve well-known vulnerabilities in mountd, IMAP, POP3, and several RPC services. These services are installed and enabled by default in some operating systems. See the following advisories for more information: sunrpc (TCP port 111) and mountd (635) [18]http://www.cert.org/advisories/CA-98.12.mountd.html [19]http://www.cert.org/incident_notes/IN-99-04.html IMAP (TCP port 143) [20]http://www.cert.org/advisories/CA-98.09.imapd.html POP3 (TCP port 110) [21]http://www.cert.org/advisories/CA-98.08.qpopper_vul.html DNS (TCP port 53 [domain]) [22]http://www.cert.org/advisories/CA-98.05.bind_problems.htm l [23]http://www.cert.org/advisories/CA-97.22.bind.html These scans involve known vulnerabilities for which patches are available. Protect your systems by making sure that they are properly secured. ______________________________________________________________________ What's New and Updated Since the last CERT summary, we have developed new and updated * Advisories * Courses * Incident notes * Security improvement modules * Technical reports * Tech tips * Virus resources There are descriptions of these documents and links to them on our "What's New" web page at [24]http://www.cert.org/nav/whatsnew.html ______________________________________________________________________ This document is available from: [25]http://www2.fedcirc.gov/advisories/FA-99-13.html ______________________________________________________________________ FedCIRC Contact Information Email: [26]fedcirc@fedcirc.gov Phone: +1 888-282-0870 (24-hour toll-free hotline) Phone: +1 412-268-6321 (24-hour hotline) Fax: +1 412-268-6989 Postal address: FedCIRC CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. FedCIRC personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from [27]http://www2.fedcirc.gov/keys.html If you prefer to use DES, please call the FedCIRC hotline for more information. Getting security information FedCIRC publications and other security information are available from our web site [28]http://www.fedcirc.gov/ FedCIRC (Federal Computer Incident Response Capability) is operated by the CERT/CC for the U.S. General Services Administration. FedCIRC provides security services to U.S. Federal civilian agencies. Copyright 1999 Carnegie Mellon University. Conditions for use, disclaimers, and sponsorship information can be found in [29]http://www.cert.org/legal_stuff.html * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office. ______________________________________________________________________ NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. References 1. http://www2.fedcirc.gov/summaries/ 2. http://www2.fedcirc.gov/pgp/newpgp.html 3. http://www2.fedcirc.gov/current/current_activity.html 4. http://www2.fedcirc.gov/summaries/CS-99-02.html 5. http://www2.fedcirc.gov/incident_notes/IN-99-04.html 6. http://www2.fedcirc.gov/advisories/CA-99-08-cmsd.html 7. http://www2.fedcirc.gov/incident_notes/IN-99-04.html 8. http://www2.fedcirc.gov/advisories/CA-99-05-statd-automountd.html 9. http://www2.fedcirc.gov/incident_notes/IN-99-04.html 10. http://www2.fedcirc.gov/advisories/CA-98.11.tooltalk.html 11. http://www2.fedcirc.gov/advisories/CA-99-06-explorezip.html 12. http://www2.fedcirc.gov/advisories/CA-99-02-Trojan-Horses.html 13. http://www2.fedcirc.gov/incident_notes/IN-99-01.html 14. http://www2.fedcirc.gov/incident_notes/IN-98-06.html 15. http://www2.fedcirc.gov/incident_notes/IN-98-05.html 16. http://www2.fedcirc.gov/incident_notes/IN-98.04.html 17. http://www2.fedcirc.gov/incident_notes/IN-98.02.html 18. http://www2.fedcirc.gov/advisories/CA-98.12.mountd.html 19. http://www2.fedcirc.gov/incident_notes/IN-99-04.html 20. http://www2.fedcirc.gov/advisories/CA-98.09.imapd.html 21. http://www2.fedcirc.gov/advisories/CA-98.08.qpopper_vul.html 22. http://www2.fedcirc.gov/advisories/CA-98.05.bind_problems.html 23. http://www2.fedcirc.gov/advisories/CA-97.22.bind.html 24. http://www2.fedcirc.gov/nav/whatsnew.html 25. http://www2.fedcirc.gov/advisories/FA-99-13.html 26. mailto:fedcirc@fedcirc.gov 27. http://www2.fedcirc.gov/keys.html 28. http://www.fedcirc.gov/ 29. http://www.cert.org/legal_stuff.html