__________________________________________________________
	
						   The U.S. Department of Energy
					   Computer Incident Advisory Capability
							   ___  __ __    _     ___
							  /       |     /_\   /
							  \___  __|__  /   \  \___
				 __________________________________________________________
	
								 INFORMATION BULLETIN
	
			Security Vulnerability in the Sun Ray Server Software Admin GUI
								 [Sun Alert ID: 102779]
	
	January 24, 2007 18:00 GMT                                        Number R-111
	______________________________________________________________________________
	PROBLEM:       Due to a security vulnerability in the Sun Ray Server Software, 
				   an unprivileged local user may be able to intercept the Sun Ray 
				   administrator's (utadmin) password when the administrator logs 
				   in to the Sun Ray Administration Tool. 
	PLATFORM:      Sun Ray Server Software 2.0 and 3.0 
	DAMAGE:        An unprivileged local user may be able to intercept the Sun Ray 
				   administrator's (utadmin) password when the administrator logs 
				   in to the Sun Ray Administration Tool. 
	SOLUTION:      Upgrade to the appropriate version. 
	______________________________________________________________________________
	VULNERABILITY  The risk is MEDIUM. An unprivileged local user may be able to 
	ASSESSMENT:    intercept the Sun Ray administrator's (utadmin) password when 
				   the administrator logs in to the Sun Ray Administration Tool. 
	______________________________________________________________________________
	LINKS: 
	 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/r-111.shtml 
	 ORIGINAL BULLETIN:  Sun Alert ID: 102779                                                         
						 http://www.sunsolve.sun.com/search/document.do?assetkey=
									1-26-102779-1 
	______________________________________________________________________________
	[***** Start Sun Alert ID: 102779 *****]
	
	Sun(sm) Alert Notification
	Sun Alert ID: 102779
	Synopsis: Security Vulnerability in the Sun Ray Server Software Admin GUI
	Category: Security
	Product: Sun Ray Server Software 3.0, Sun Ray Server Software 2.0
	BugIDs: 4950642
	Avoidance: Patch
	State: Resolved
	Date Released: 23-Jan-2007
	Date Closed: 23-Jan-2007
	Date Modified: 
	
	
	1. Impact
	Due to a security vulnerability in the Sun Ray Server Software, an unprivileged 
	local user may be able to intercept the Sun Ray administrator's (utadmin) 
	password when the administrator logs in to the Sun Ray Administration Tool.
	
	In addition, a user who obtains read access to the Sun Ray private web server's 
	logfile, or to a similar logfile on a proxy server, can extract the Sun Ray 
	administrator's (utadmin) password. This would allow the user to gain 
	unauthorized access to the Sun Ray Server Software with the privileges of the 
	utadmin user.
	
	
	2. Contributing Factors
	This issue can occur in the following releases:
	
	SPARC Platform
	
	Sun Ray Server Software 2.0 (for Solaris 8, 9) without patch 114880-10
	Sun Ray Server Software 3.0 (for Solaris 8, 9, 10) without patch 118979-02
	Linux Platform
	
	Sun Ray Server Software 3.0 (for JDS R2, RHELAS 3.0, SLES 8.0) without patch 
	119836-02
	
	To determine the version of the Sun Ray Server Software on a Solaris system, 
	the following command can be run:
	
		# /usr/bin/pkginfo -l SUNWuto | grep -i version
		VERSION: 3.1_32,REV=2005.08.24.08.55
		
	To determine the version of Sun Ray Server Software on a Linux system, the 
	following command can be run:
	
		# /bin/rpm -q SUNWuto
		SUNWuto-3.1-32.21
	
	Notes:
	
	Sun Ray Server Software 3.1 and Sun Ray Server Software 3.1.1 are not 
	affected by this issue.
	This issue can occur both when the Sun Ray web administration GUI is 
	configured to use SSL, and when it is configured not to use SSL.
	Sun Ray Server Software 1.0, 1.1, 1.2 and 1.3 will not be evaluated 
	regarding the potential impact of the issue described in this Sun Alert 
	document.
	
	
	3. Symptoms
	If the Sun Ray server has been affected by the issue described in this Sun 
	Alert, the password may appear in the log file of the web server that is in 
	use.
	
	To determine if a Sun Ray server has been affected by this issue, check the 
	web server logfile as follows:
	
	1. Open the web server logfile in an editor.
	
	2. Use the editor's functionality to search for the Sun Ray 
	admininistrator's (utadmin) password.
	
	Note: Do not use "grep" to search for the utadmin password, as this might 
	cause the password to be visible in the process list for a very short time, 
	and to be logged to your shell's history.
	
	On Sun Ray Server Software 3.0, the logfile location is defined in httpd.conf. 
	The location of the httpd.conf file is stored in the utadmin.conf file:
	
	On Solaris:
	
		# /usr/bin/grep http.cfile /etc/opt/SUNWut/utadmin.conf
		admin.http.cfile   = /etc/apache/httpd.conf
		
	In httpd.conf:
	
		CustomLog /var/apache/logs/access_log common
		ErrorLog /var/apache/logs/error_log
	 
	
	On Red Hat Linux Advanced Server Release 3:
	
		# /bin/grep http.cfile /etc/opt/SUNWut/utadmin.conf
		admin.http.cfile  = /etc/httpd/conf/httpd.conf
		
	In httpd.conf:
	
		CustomLog logs/access_log common
		ErrorLog logs/error_log
		
	The default location of the logfiles is "/var/log/httpd/access_log" and 
	"/var/log/httpd/error_log".
	
	 
	
	On SuSE Linux Enterprise Server 8:
	
		# /bin/grep http.cfile /etc/opt/SUNWut/utadmin.conf
		admin.http.cfile   = /etc/httpd/conf/httpd.conf
		
	In httpd.conf:
	
		CustomLog /var/log/httpd/access_log common
		ErrorLog /var/log/httpd/error_log
		
	The default location of the logfiles is "/var/log/httpd/access_log" and 
	"/var/log/httpd/error_log".
	
	 
	
	On JDS 2:
	
	JDS 2 does not provide an Apache web server by default. Use the following 
	to identify the location of the httpd.conf:
	
		# grep http.cfile /etc/opt/SUNWut/utadmin.conf
		
	On Sun Ray Server Software 2.0, the web server logfiles are located in the 
	following directory:
	
		/var/opt/SUNWut/http/utadmin/websites/default_site/logs/
	 
	
	
	
	Solution Summary Top 
	
	
	4. Relief/Workaround
	To work around the described issue, do the following (use the command line 
	tools rather than the Sun Ray web administration GUI):
	
	1. To ensure that nobody else uses the web administration GUI, remove the 
	execute permissions from the "main" binary:
	
		# chmod a-x /opt/SUNWut/cgi-bin/main
		
	To undo the workaround:
	
		# chmod a+x /opt/SUNWut/cgi-bin/main
		
	2. Ensure that only the root user has read access rights to the web server 
	logfiles by changing the permissions of those files using a command such as 
	chmod(1) as required. By default:
	
	with Sun Ray Server Software 3.0/Solaris, using Solaris bundled Apache, the 
	web server logfiles are world-readable.
	
	with Sun Ray Server Software 3.0/Linux, using Apache, the directory containing 
	the web server logfiles is accessible for the root user only.
	with Sun Ray Server Software 2.0 and earlier, the web server logfiles are 
	accessible for the root user and group "other" only.
	
	
	3. Change the Sun Ray administrator's password by doing the following:
	
		# /opt/SUNWut/sbin/utpw
		Enter new UT admin password:
		Re-enter new UT admin password:
		Enter old UT admin password:
	
		Changing LDAP password...
		Done.
		Changing password file...
		Done.
		
	Note: If this server is part of a failover configuration, please run 
	utpw(1M) on all servers.
	
	
	4. If you have used the Sun Ray administrator's password for other purposes, 
	change that password as well.
	
	
	
	5. Resolution
	This issue is addressed in the following releases:
	
	SPARC Platform
	
	Sun Ray Server Software 2.0 (for Solaris 8, 9) with patch 114880-10 or later
	Sun Ray Server Software 3.0 (for Solaris 8, 9, 10) with patch 118979-02 or later 
	
	
	Linux Platform
	
	Sun Ray Server Software 3.0 (for JDS R2, RHELAS 3.0, SLES 8.0) with patch 
	119836-02 or later
	
	Note: The above patch revisions do not clean up old logfiles, and they do not 
	re-render pages which have already been displayed in your browser. After patch 
	installation it is recommended that the administrator password be changed 
	(using the method described in section 4, Relief/Workaround). In addition, 
	before logging into the Sun Ray web administration GUI, users should either 
	restart the browser or hit shift-reload on the GUI's login screen.
	
	
	
	This Sun Alert notification is being provided to you on an "AS IS" basis. This 
	Sun Alert notification may contain information provided by third parties. The 
	issues described in this Sun Alert notification may or may not impact your 
	system(s). Sun makes no representations, warranties, or guarantees as to the 
	information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, 
	INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A 
	PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING 
	THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY 
	DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE 
	OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun 
	Alert notification contains Sun proprietary and confidential information. It 
	is being provided to you pursuant to the provisions of your agreement to 
	purchase services from Sun, or, if you do not have such an agreement, the 
	Sun.com Terms of Use. This Sun Alert notification may only be used for the 
	purposes contemplated by these agreements.
	
	
	Copyright 2000-2006 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, 
	CA 95054 U.S.A. All rights reserved.
	
	
	
	
	
	[***** End Sun Alert ID: 102779 *****]
	_______________________________________________________________________________
	
	CIAC wishes to acknowledge the contributions of Sun Microsystems for the 
	information contained in this bulletin.
	_______________________________________________________________________________
	
	
	CIAC, the Computer Incident Advisory Capability, is the computer
	security incident response team for the U.S. Department of Energy
	(DOE) and the emergency backup response team for the National
	Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
	National Laboratory in Livermore, California. CIAC is also a founding
	member of FIRST, the Forum of Incident Response and Security Teams, a
	global organization established to foster cooperation and coordination
	among computer security teams worldwide.
	
	CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
	can be contacted at:
		Voice:    +1 925-422-8193 (7x24)
		FAX:      +1 925-423-8002
		STU-III:  +1 925-423-2604
		E-mail:   ciac@ciac.org
	
	Previous CIAC notices, anti-virus software, and other information are
	available from the CIAC Computer Security Archive.
	
	   World Wide Web:      http://www.ciac.org/
	   Anonymous FTP:       ftp.ciac.org
	
	PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
	communities receive CIAC bulletins.  If you are not part of these
	communities, please contact your agency's response team to report
	incidents. Your agency's team will coordinate with CIAC. The Forum of
	Incident Response and Security Teams (FIRST) is a world-wide
	organization. A list of FIRST member organizations and their
	constituencies can be obtained via WWW at http://www.first.org/.
	
	This document was prepared as an account of work sponsored by an
	agency of the United States Government. Neither the United States
	Government nor the University of California nor any of their
	employees, makes any warranty, express or implied, or assumes any
	legal liability or responsibility for the accuracy, completeness, or
	usefulness of any information, apparatus, product, or process
	disclosed, or represents that its use would not infringe privately
	owned rights. Reference herein to any specific commercial products,
	process, or service by trade name, trademark, manufacturer, or
	otherwise, does not necessarily constitute or imply its endorsement,
	recommendation or favoring by the United States Government or the
	University of California. The views and opinions of authors expressed
	herein do not necessarily state or reflect those of the United States
	Government or the University of California, and shall not be used for
	advertising or product endorsement purposes.
	
	LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
	
	R-101: Multiple Vulnerabilities in Cisco Secure Access Control Server
	R-102: Vulnerability in Microsoft Outlook (925938)
	R-103: Vulnerability in Vector Markup Language (929969)
	R-104: Vulnerabilities in Microsoft Excel (927198)
	R-105: XFree86 and xorg-x11 Security Update
	R-106: libgsf Security Update
	R-107: HP OpenView Network Node Manager (OV NNM) Remote Unauthorized Execution of Arbitrary Code
	R-108: Security Vulnerability in Processing GIF Images in the Java Runtime Environment
	R-109: Security Vulnerabilities: Buffer Overrun in NetMail 3.52
	R-110: eIQnetworks Enterprise SEcurity Analyzer Syslog Server Buffer Overflow