New OFFICIAL patch for BSD/OS 2.1 (*SECURITY*) (fwd)

[soil () QUICK NET (Josh Gilliam)]

---------- Forwarded message ----------
Message-Id: <199702072348.QAA02275 () external BSDI COM>
Date: Fri, 7 Feb 1997 16:48:05 -0700 (MST)
From: polk () BSDI COM
To: customers () BSDI COM
Subject: New OFFICIAL patch for BSD/OS 2.1 (*SECURITY*)

There is a new security patch, U210-037 (domestic version D210-037
for sites running the Kerberos package installed from the DOMESTIC
floppy), which solves a security problem related to source routed
packets in the rlogind, rshd, tcpd, and nfsd system daemons.

The README file entry for the patch is included below.

BSDI always appreciates being advised of security problems.  Please
send reports of suspected security problems to bsdi-security () BSDI COM.

The patches are available via ftp at:
        ftp://ftp.bsdi.com/bsdi/patches/patches-2.1
or via the <patches () BSDI COM> email server.

Jeff
--
     /\   Jeff Polk            Berkeley Software Design, Inc. (BSDI)
  /\/  \  polk () BSDI COM        5575 Tech Center Dr. #110, Colo Spgs, CO 80919

===================================================================

PATCH:
    U210-037    (normal version)
    D210-037    (kerberos version)

SUMMARY:
        This patch fixes a security hole that can allow unauthorized
        remote access.  In addition to installing this patch, another
        way to protect your systems from this attack is to disallow
        IP source routed packets from entering your networks.  If your
        gateway is a BSD/OS system, this can be done via:

                /sbin/sysctl -w net.inet.ip.forwsrcrt=0

        Note that the kerberized versions of rsh and rlogind are not at
        risk to this attack.  It is only the use of .rhosts for allowing
        access to the system that is at risk.

        Most sites should install the U210-037 version.  Only sites
        who have installed the Kerberos package from the DOMESTIC
        floppy should install the D210-037 version of this patch.

        The tcpd source change is simply to remove the -DKILL_IP_OPTIONS
        option from the CLFLAGS definition in Makefile.defs.  This change
        is not included in the source patches below.

        BSDI would like to thank Oliver Friedrichs and Secure
        Networks Inc., for identifying this problem and possible
        solutions to it.

md5 checksum: aded511e67e025a21295e15fa5bd7690 U210-037
md5 checksum: 78594e78579f1e26f7023f690f1d3060 D210-037

===================================================================