|
 |
CERT® Advisory CA-1994-10 IBM AIX bsh VulnerabilityOriginal issue date: June 3, 1994Last revised: September 23, 1997 Updated copyright statement A complete revision history is at the end of this file. The CERT Coordination Center has learned of a vulnerability in the batch queue (bsh) of IBM AIX systems running versions prior to and including AIX 3.2. CERT recommends disabling the batch queue by following the workaround instructions in Section III below. Section III also includes information on how to obtain fixes from IBM if the bsh queue functionality is required by remote systems. We will update this advisory as we receive additional information. Please check advisory files regularly for updates that relate to your site. I. DescriptionThe queueing system on IBM AIX includes a batch queue, "bsh", which is turned on by default in /etc/qconfig on all versions of AIX 3 and earlier.II. ImpactIf network printing is enabled, remote and local users can gain access to a privileged account.III. SolutionIn the next release of AIX, the bsh queue will be turned off by default. CERT/CC recommends that the bsh queue be turned off using the workaround described in Section A below unless there is an explicit need to support this functionality for remote hosts. If this functionality must be supported, IBM provides fixes as outlined in Sections B and C below. For questions concerning these workarounds or fixes, please contact IBM at the number provided below.A. WorkaroundDisable the bsh queue by following one of the two procedures outlined below:1. As root, from the command line, enter:# chque -qbsh -a"up = FALSE" 2. From SMIT, enter:
B. Emergency fixObtain and install the emergency fix for the version(s) of AIX used at your site. Fixes for the various levels of AIX are available by anonymous FTP from software.watson.ibm.com. The files are located in /pub/aix/bshfix.tar.Z in compressed tar format. Installation instructions are included in the README file included as part of the tar file.The directory /pub/aix contains the latest available emergency fix for APAR IX44381. As updates become available, any new versions will be placed in this directory with the name bshfix<#>.tar.Z with <#> being incremented for each update. See the README.FIRST file in that directory for details. IBM may remove this emergency fix file without prior notice if flaws are reported. Due to the changing nature of these files, no checksum information is available. C. Official fixThe official fix for this problem can be ordered as APAR IX44381.To order APARs from IBM in the U.S., call 1-800-237-5511 and ask that it be shipped to you as soon as it is available. To obtain APARs outside of the U.S., contact your local IBM representative. The CERT Coordination Center wishes to thank Gordon C. Galligher of Information Resources, Inc. for reporting this problem and IBM Corporation for their support in responding to this problem. This document is available from: http://www.cert.org/advisories/CA-1994-10.html CERT/CC Contact Information
Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryptionWe strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from If you prefer to use DES, please call the CERT hotline for more information. Getting security informationCERT publications and other security information are available from our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
NO WARRANTY Conditions for use, disclaimers, and sponsorship information
Copyright 1994 Carnegie Mellon University. Revision History
Sep. 23. 1997 Updated copyright statement
Aug. 30, 1996 Removed references to README files because advisories
themselves are now updated.
|
