Patch-ID# 100482-06
Keywords: security ypserv ypxfrd maps DNS res_send resolv.conf nameserver 
Synopsis: SunOS 4.1;4.1.1;4.1.2;4.1.3: ypserv and ypxfrd fix, plus DNS fix
Date: Oct/17/94

Solaris Release: 1.1
 
SunOS Release: 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.3C
 
Unbundled Product: 
 
Unbundled Release:
 
Topic: ypserv and ypxfrd security patch, plus DNS patch

BugId's fixed with this patch: 1036869 1039839 1082319 1082320 1080353 1076977

Changes incorporated in this version: 

Relevant Architectures: sun3(all), sun4(all)

Patches accumulated and obsoleted by this patch: 100465

Patches which conflict with this patch:

Patches required with this patch:

Obsoleted by: 

Problem Description: 

  The changes in this version of the patch are related to, and add
  functionality to, SunOS4.1.3 sun4 machines only.
  This patch incorporates multi-home support for SunClusters into the
  ypserv for sun4 machines running SunOS4.1.3.

From 100482-05:
  This patch is just a rebuild of the 4.1.1, 4.1.2 and 4.1.3 sun4
  versions of ypserv. The fix for 1080353 was missing from the
  -04 sun4 version.



        Bug 1036869
	Security -  ypserv will send maps to anyone who can guess the 
		    domainname

	Bug 1039839
	DNS used in conjunction with NIS may generate syslog messages
	to the console something like :
	nres_gethostbyaddr: some.name.org != its.correct.IP.addr

	Bug 1082319
	Security -  ypserv will send maps to anyone via the portmapper.

	Bug 1082320
	Security -  ypxfrd will send maps to anyone.
	Ypxfrd does not check whether the person transferring the map 
	is root on  his machine, when the map is ``secure''. As a 
	consequence, any user can get the password map if the
	NIS master is running ypxfrd.

	Bug 1080353
    	The problem is whenever the primary name server downloads an 
      	'A' record to the secondary system and this 'A' record contains 
	more then 36 IP addresses. It will cause ypserv on the 
	secondary system to dump core.

	Bug 1076977
	DNS lookup will fail if the first nameserver in /etc/resolv.conf 
	is up but has no nameserver daemon running. The ECONNREFUSED will 
	be carried on down to the other nameservers listed in resolv.conf 
	even if they are up and their nameserver daemons are running.



Comments:

This patch contains the following fixes:

	1. ypserv - for bug 1036869, 1039839 and 1080353.
	2. ypxfrd - for bug 1082320.
	3. portmap - for bug 1082319.

In order to prevent these NIS security problems, all of the
above fixes need to work together. 

Both the "ypserv" and "ypxfrd" patch use a /var/yp/securenets 
file and, if present, only responds to IP addresses in the 
range given. This file is only read when the daemons (both
ypserv & ypxfrd) start. To get a change in /var/yp/securenets
to take effect, one must kill and restart the daemons.


The format of the file is one of more lines of:

	netmask netaddr

	e.g. 

	255.255.0.0 128.30.0.0
	255.255.255.0 128.311.10.0

	In the 2nd example, the netmask is 255.255.255.0 
	and the network address is 128.311.10.0 . This 
	setup will only allow the ypserv to respond to 
	those IP addresses which are within the subnet 
	128.311.10 range. 

Install:

As root and for the correct architecture directory.

#save original binaries

  mv /usr/etc/ypserv /usr/etc/ypserv.orig
  mv /usr/etc/ypxfrd /usr/etc/ypxfrd.orig
  mv /usr/etc/portmap /usr/etc/portmap.orig
  chmod 0400 /usr/etc/ypserv.orig
  chmod 0400 /usr/etc/ypxfrd.orig
  chmod 0400 /usr/etc/portmap.orig

#copy the new version to /usr/etc

  cp `arch`/{4.1, 4.1.1, 4.1.2, 4.1.3}/ypserv /usr/etc/ypserv
  cp `arch`/{4.1, 4.1.1, 4.1.2, 4.1.3}/ypxfrd /usr/etc/ypxfrd
  cp `arch`/{4.1, 4.1.1, 4.1.2, 4.1.3}/portmap /usr/etc/portmap
 
  chown root.staff /usr/etc/ypserv
  chmod 755  /usr/etc/ypserv
 
  chown root.staff /usr/etc/ypxfrd
  chmod 755  /usr/etc/ypxfrd
 
  chown root.staff /usr/etc/portmap
  chmod 755  /usr/etc/portmap


#copy the securenets file to /var/yp

  cp `arch`/{4.1, 4.1.1, 4.1.2, 4.1.3}/securenets /var/yp
 
  chown root.staff /var/yp/securenets
  chmod 644 /var/yp/securenets

#edit the securenets file and make the appropriate changes.

#reboot the system to invoke the new binaries.