-----BEGIN PGP SIGNED MESSAGE-----

                            CERT Coordination Center
                              xterm Vendor Status
                               December 2, 1993


This file is a supplement to the CERT Advisory CA-93:17 of November 11, 1993,
and will be updated as additional information becomes available.

The following is vendor-supplied information.  The CERT Coordination Center
will not formally review, evaluate, or endorse this information. For more
up-to-date information, contact your vendor. 

It is important to note that the vendor of your xterm may not be the same
as the vendor of your platform.  You should take care to correctly identify
the vendor whose xterm you are using, so you can take the appropriate action.  



	Convex	   Fixed in CXwindows V3.1.  Fixed in CXwindows V3.0
		   with TAC patch V3.0.131 applied.  The Convex Technical 
                   Assistance Center is available for additional information
                   at 800-952-0379.

	Cray       Fixed in Cray Visualization Tookit (CVT) version 2.0 and
                   later.  Cray Research customers should see ISFN#211, 
                   dated 93/04/21.

        DEC/OSF    Attached is the information on the remedial images to
                   address the xterm issue for ULTRIX V4.3 (VAX & RISC) 
		   and OSF/1 V1.2.   The solutions have been included in
		   ULTRIX V4.4 (VAX & RISC) and OSF/1 V1.3. 

                   Customers may call their normal Digital Multivendor 
                   Customer Services Support Channel to obtain this kit.

                   ----------------------------------------------------------
                   *ULTRIX,OSF/1] CSCPAT_4034 xterm Security Fix ECO Summary


                   COPYRIGHT (c) 1988, 1993 by Digital Equipment Corporation.
                   ALL RIGHTS RESERVED.

                   COMPONENT:  xterm

                   OP/SYS:     ULTRIX VAX and RISC, OSF/1

                   SOURCE:     Digital Customer Support Center

                   ECO INFORMATION:

                   CSCPAT Kit:                  CSCPAT_4034 V1.1
                   CSCPAT Kit Size:             2152 blocks
                   Engineering Cross Reference: SSRT93-E-0230, SSRT93-E-0231,
                                                SSRT93-E-232
                   Kit Applies To:              ULTRIX V4.3, OSF/1 V1.2
                   System Reboot Required:      NO
                   ----------------------------------------------------------

        SCO        The current releases listed below are not vulnerable to
                   this problem.  No xterm logging or scoterm logging is
                   provided:

                   SCO Open Desktop Lite, Release 3.0
                   SCO Open Desktop, Release 3.0
                   SCO Open Server Network System, Release 3.0
                   SCO Open Server Enterprise System, Release 3.0

                   Contact SCO for any further information.

	Sequent    Fixed. Contact Sequent for version/patch numbers.

	Sun        Sun's version of xterm has not been setuid root since at 
                   least as far back as SunOS 4.1.1, and probably further.  
                   An xterm that does not run setuid or setgid is not
                   vulnerable to the xterm logging problem.

                   CAUTION: A Sun patch (#100728-02) was issued on December 9,
                   1992 to give system administrators the option of running 
                   xterm setuid root.  Installing this patch will introduce 
                   the xterm logging vulnerability.  So check your xterm.  If
                   either the setuid or setgid privilege bit is set on the 
                   xterm program, the vulnerability can be exploited.  Contact
                   Sun for further information.

	X.org      (Publicly distributed version of X.)  You can patch X11R5
		   by applying all patches up to and including fix-26.  See
		   the associated CERT Advisory (CA-93:17) for further 
                   information.



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMaMycXVP+x0t4w7BAQHi5gQA3N7OmcdnqFkvW1vYw2L1oL4+lifXhbOb
H1GkL0ezcy+NHhY8Hhem/OvGmHle/3V9t4lC4mq4nERbMFKhoXj/ySivWkkk1LQq
BcaV4+oxXiC2FF4ObJm0toJxBnWX+/JG4U52tbalfx9mBrTP3mDkxvsEvOs2WaUn
O5OwN0IMoQs=
=dKoL
-----END PGP SIGNATURE-----
