-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
              AUSCERT External Security Bulletin Redistribution
                             
                    ESB-1999.196 -- CERT Summary CS-99-05
                                CERT Summary
                              20 December 1999

===========================================================================

The CERT Coordination Centre has released the following summary concerning
types of attacks currently being reported and Year 2000 (Y2K).  AusCERT has 
noted similar attack trends within Australia and New Zealand and has helped
to formulate the content of the Year 2000 (Y2K) information provided.


- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CERT Summary CS-99-05

   December 17, 1999
   
   Each quarter, the CERT Coordination Center (CERT/CC) issues the CERT
   summary to draw attention to the types of attacks reported to our
   incident response team, as well as other noteworthy incident and
   vulnerability information. The summary includes pointers to sources of
   information for dealing with the problems. Occasionally, "special
   editions" such as this one are published.
   
   Past CERT summaries are available from
   http://www.cert.org/summaries/
   ______________________________________________________________________
   
"CERT/CC Current Activity" Web Page

   The CERT/CC Current Activity web page is a regularly updated summary
   of the most frequent, high-impact types of security incidents and
   vulnerabilities currently being reported to the CERT/CC. It is
   available from
   
   http://www.cert.org/current/current_activity.html
       
   The information on the Current Activity page will be reviewed and
   updated as reporting trends change.
   ______________________________________________________________________
   
Year 2000 (Y2K) Information

   The CERT/CC has recently published web pages to assist sites in
   dealing with Y2K-related security issues.
   
   Y2K FAQ - Our Y2K FAQ has been extensively revised in collaboration
          with participants in the International Y2K workshop held in
          October 1999. The FAQ includes information to help sites
          determine whether a failure is Y2K related or an attack. The
          FAQ is available at
          
          http://www.cert.org/y2k-info/Y2K_FAQ.html
          
   Expectations During Y2K - "Cyber Infrastructure and Malicious
          Expectations during the Y2K Transition Period," also a
          collaborative effort by members of the Threat Analysis Working
          Group at the International Y2K Workshop, discusses potential
          activities associated with Y2K and offers recommendations. This
          paper is available at
          http://www.cert.org/y2k-info/y2k-cyberthreats
          
   Year 2000 Computer Viruses and Hoaxes - This web page lists the
          approximate number of reports the CERT/CC has received on
          viruses and hoaxes that reference Y2K. There are also links to
          anti-virus vendors having Y2K virus and hoax web pages. Our
          list is available at
          http://www.cert.org/y2k-info/y2k-virus.html
          
   Y2K status reports - During the Y2K event, the CERT/CC will publish
          regular reports on our web site to inform the community of
          activity being reported to us by other response teams and
          sites. Those reports will be available at
          http://www.cert.org/y2k-info/y2k-status.html
          
   Reporting new security information
   We encourage sites that discover new vulnerabilities or witness new
   types of attacks to report those to us by sending electronic mail to
   cert@cert.org
   
   Backup CERT hotline
   During the Y2K event, we will have backup hotline in case of a
   telecommunications failure with our primary hotline. The backup
   hotline phone number is
   
   +1 412 818-3442
          
   This backup hotline will be staffed only if the primary hotline fails.
   ______________________________________________________________________
   
Results of the Distributed-Systems Intruder Tools (DSIT) Workshop

   In November 1999, experts addressed issues surrounding
   distributed-systems intruder tools. A paper now available at the
   CERT/CC web site is one outcome of the DSIT Workshop. In it, workshop
   participants examine the use of distributed-system intruder tools and
   provide information about protecting systems from attack by the tools,
   detecting the use of the tools, and responding to attacks. The paper
   is available at
   http://www.cert.org/reports/dsit_workshop.pdf
   ______________________________________________________________________
   
Ongoing Intruder Activity

   Distributed denial-of-service tools are continuing to be found on
   compromised hosts. In addition to the information provided by the
   Distributed-Systems Intruder Tools Workshop mentioned above, please
   see
   http://www.cert.org/incident_notes/IN-99-07.html
       
   Intruders continue to exploit a vulnerability in the am-utils package
   to gain root access to victim machines. For details, see
   http://www.cert.org/incident_notes/IN-99-05.html
       
   Finally, RPC service vulnerabilities are still being regularly
   exploited: rpc.ttdbserverd, rpc.cmsd, statd-automound. Details and
   pointers to additional information can be found in
   http://www.cert.org/incident_notes/IN-99-04.html
   ______________________________________________________________________
   
   This document is available from:
   http://www.cert.org/summaries/CS-99-05.html
   ______________________________________________________________________
   
CERT/CC Contact Information

   Email: cert@cert.org
          Phone: +1 412-268-7090 (24-hour hotline)
          Fax: +1 412-268-6989
          Postal address:
          CERT Coordination Center
          Software Engineering Institute
          Carnegie Mellon University
          Pittsburgh PA 15213-3890
          U.S.A.
          
   CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4)
   Monday through Friday; they are on call for emergencies during other
   hours, on U.S. holidays, and on weekends.
   
Using encryption

   We strongly urge you to encrypt sensitive information sent by email.
   Our public PGP key is available from
   
   http://www.cert.org/CERT_PGP.key
       
   If you prefer to use DES, please call the CERT hotline for more
   information.
   
Getting security information

   CERT publications and other security information are available from
   our web site
   
   http://www.cert.org/
       
   To be added to our mailing list for advisories and bulletins, send
   email to cert-advisory-request@cert.org and include SUBSCRIBE
   your-email-address in the subject of your message.
   
   Copyright 1999 Carnegie Mellon University.
   Conditions for use, disclaimers, and sponsorship information can be
   found in
   
   http://www.cert.org/legal_stuff.html
       
   * "CERT" and "CERT Coordination Center" are registered in the U.S.
   Patent and Trademark Office.
   ______________________________________________________________________
   
   NO WARRANTY
   Any material furnished by Carnegie Mellon University and the Software
   Engineering Institute is furnished on an "as is" basis. Carnegie
   Mellon University makes no warranties of any kind, either expressed or
   implied as to any matter including, but not limited to, warranty of
   fitness for a particular purpose or merchantability, exclusivity or
   results obtained from use of the material. Carnegie Mellon University
   does not make any warranty of any kind with respect to freedom from
   patent, trademark, or copyright infringement.

- -----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBOFqGOlr9kb5qlZHQEQLWNACfWkhN6a0Q8L6RdG7G07RJlMFdWOQAoNlO
bPEffGaq1aa9quVfN2ys4N2a
=iGzX
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBOF+cPih9+71yA2DNAQHsZAP+LxiekqfzTP73rrZehd2RklJB3ZqIYXUi
DgrFCr0jVF0Ki17fxVZrIR2QVOYsSq7czNk78KnjM6oflgWfKvz9t0Hn2mzMwzw7
MWH9pER3vv36KUFRhNmTOpUfGaU6s0u/UTX2bH04Ynu4pUtBtw5U1iNechHZ+pp6
UddDrmdShLA=
=/c/q
-----END PGP SIGNATURE-----