-----BEGIN PGP SIGNED MESSAGE-----

IBM SECURITY ADVISORY

Mon Oct 29 09:15:39 CST 2001
===========================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:    Buffer oveflow vulnerability in CDE DtSvc library

PLATFORMS:        IBM AIX 4.3 and 5.1

SOLUTION:         Apply the emergency-fixes described below

THREAT:           Malicious user can obtain elevated privileges

CERT Advisory:    NONE

===========================================================================
                           DETAILED INFORMATION

I.  Description

A buffer overflow vulnerability has been found in the Common Desktop
Environment (CDE) libDtSvc.a library.

The vulnerability is invoked when a user passes a properly coded string to any
of the "dt" commands (e.g., dtprintinfo and dtterm) using the "-session"
option.


II. Impact

A malicious local user can use a well-crafted exploit code to gain elevated,
possibly root, privileges on the attacked system, compromising the integrity of
the system and its attached local network.

The exploitability of this vulnerability has not been studied completely.
Nonetheless, AIX system administrators and security personnel are urged to
apply the emergency patches being made available to preclude a possibly serious
attack.

III.  Solutions

  A.  Official fix

IBM is working on the following fixes which will be available soon:

AIX 5.1:  Pending assignment - the README file in the efix download directory
will be updated as soon as the assignment is made.

AIX 4.3:  APAR #IY24596

The APARs for AIX 4.3 and 5.1 will not be available until late November 2001.

NOTE: Fix will not be provided for versions prior to 4.3 as these are no longer
supported by IBM. Affected customers are urged to upgrade to 4.3.3 at the
latest maintenance level, or to 5.1.


  B.  How to minimize the vulnerability


WORKAROUND

None, other than disabling the CDE. 

EMERGENCY FIX (efix):

Temporary fixes for AIX 4.3.x and 5.1 systems are available.

The temporary fixes can be downloaded via ftp from:

ftp://aix.software.ibm.com/aix/efixes/security

The name of the efix you want to download to close this vulnerability is
CDE_libDtSvc_efix.tar.Z.

The efix compressed tarball contains a copy of this Advisory and another
tarfile, efix_binaries.tar. This latter tarfile will untar into two binary efix
files, libDtSvc.a_43 and libDtSvc.a_51, for AIX 4.3 and 5.1, respectively. In
addition, there is a detached PGP signature file for efix_binaries.tar. The
proper signature is that of AIX Security <security-alert@austin.ibm.com>.

These temporary fixes have not been fully regression tested; thus,
IBM does not warrant the fully correct functioning of the efix.
Customers install the efix and operate the modified version of AIX
at their own risk.

To proceed with efix installation:

First, verify the MD5 cryptographic hash sum of efix_binaries.tar you obtain
from unpacking the downloaded compressed tarball with that given below. These
should match exactly; if they do not, double check the hash results and the
download site address. If OK, contact IBM AIX Security at
security-alert@austin.ibm.com and describe the discrepancy.  Also, for those
who use PGP, another security check for the integrity of the efix binaries
tarfile is the inclusion of a detached PGP signature file,
efix_binaries.tar.asc.

MD5 (efix_binaries.tar) = 31db9713ba5a6a919cc882c7a0525217

IMPORTANT NOTE REGARDING MD5:
"MD5" is "Message Digest #5". MD5 is a 128-bit one-way cryptographic hash
algorithm.  It is used to generate a crypto-secure "signature" or "fingerprint"
of a file or a directory and its files. Although not 100% infallible, MD5 is
meant to be used to generate the secure, unique fingerprint of a
file/directory, and also to generate such a fingerprint of a file/directory for
comparison with someone else's MD5 fingerprint of that file/directory. If the
fingerprints match, then the file/directory being examined has not been
modified or replaced with another. Thus, one can be reasonably certain that the
file or fileset is the one originally created by a known, trusted entity, and
passed to the intended person or people.

Source code for MD5 can be obtained at:
ftp://ftp.funet.fi/pub/crypt/hash/mds/md5 Customers should download
md5sum.tar.gz and the Makefile, and then compile to make the executable.

To generate the hash signature of a file or fileset, enter on the command line
the name of the MD5 executable followed by the name of the file/directory of
interest.

Then compare the output hash with that given above.

Finally, the use of MD5, or not using it, does not affect in any way the
installation of the efix. It is meant to be a security measure only.

    efix Installation Instructions:
    -------------------------------

1. Become root, if not already done. 

2. In the /tmp directory, uncompress and untar the efix:

       a. uncompress CDE_libDtSvc_efix.tar.Z
       b. tar -xvf efix_binaries.tar

You will now have two binary efix files: libDtSvc.a_43 and libDtSvc.a_51, one
for AIX 4.3 and the other for AIX 5.1, respectively.  You will also have a
PGP-signed copy of this advisory, named "Advisory".  There is also a detached
PGP signature of the efix_binaries.tar file.  The signature should be that of
AIX Security <security-alert@austin.ibm.com>.

Keep the binary file containing the patch for your version
of AIX. You may discard the unneeded one if you desire.

Now execute:
cp libDtSvc.a_xy libDtSvc.a  /* where "xy" is either "43" or "51" as
appropriate */

3. Follow these instructions:

To install libDtSvc.a :

cd /usr/dt/lib
mv libDtSvc.a libDtSvc.a.orig  /* make a backup of your original libDtSvc.a! */
mv /tmp/libDtSvc.a .   /* The new libDtSvc.a */
chmod 444 libDtSvc.a
chown bin:bin libDtSvc.a
slibclean


IV. Obtaining Fixes

IBM AIX APARs may be ordered using Electronic Fix Distribution (via the FixDist
program), or from the IBM Support Center.  For more information on FixDist, and
to obtain fixes via the Internet, please reference

        http://techsupport.services.ibm.com/rs6k/fixes.html

or send email to "aixserv@austin.ibm.com" with the word "FixDist" in the
"Subject:" line.

To facilitate ease of ordering all security related APARs for each AIX release,
security fixes are periodically bundled into a cumulative APAR.  For more
information on these cumulative APARs including last update and list of
individual fixes, send email to "aixserv@austin.ibm.com" with the word
"subscribe Security_APARs" in the "Subject:" line.


V.  Acknowledgements

Many thanks to Arai Yuu, of the LAC Computer Security Laboratory in Japan for
discovering this vulnerability!

VI.  Contact Information

Comments regarding the content of this announcement can be directed to:

   security-alert@austin.ibm.com

To request the PGP public key that can be used to encrypt new AIX security
vulnerabilities, send email to security-alert@austin.ibm.com with a subject of
"get key".

If you would like to subscribe to the AIX security newsletter, send a note to
aixserv@austin.ibm.com with a subject of "subscribe Security".  To cancel your
subscription, use a subject of "unsubscribe Security".  To see a list of other
available subscriptions, use a subject of "help".

IBM and AIX are a registered trademark of International Business Machines
Corporation.  All other trademarks are property of their respective holders.


-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.2

iQCVAwUBO93MtQsPbaL1YgqvAQHlPQP9Gc61t+CM4lvYG4mLGE1aEp83HodeDZhs
1wedrASQ0v88MNJh+NO2yBbGsZxMwsm0orN1aGfWXY9uvNwJeKUxWczve6b/5Zl/
i4QQcZ5An2cyWjc5tMOK3mv+8LzWrb7DgBMUVMHOChJMW9ahptfLp0rMQbzVXoiA
xV9PTgGFXlE=
=mUwr
-----END PGP SIGNATURE-----



--0__=85256AF50001FFE48f9e8a93df938690918c85256AF50001FFE4
Content-type: text/plain; charset=us-ascii

(See attached file: AIX 29Oct 2001 Advisory.txt)
--0__=85256AF50001FFE48f9e8a93df938690918c85256AF50001FFE4
Content-type: application/octet-stream; 
	name="AIX 29Oct 2001 Advisory.txt"
Content-Disposition: attachment; filename="AIX 29Oct 2001 Advisory.txt"
Content-transfer-encoding: base64

LS0tLS1CRUdJTiBQR1AgU0lHTkVEIE1FU1NBR0UtLS0tLQoKSUJNIFNFQ1VSSVRZIEFEVklTT1JZ
CgpNb24gT2N0IDI5IDA5OjE1OjM5IENTVCAyMDAxCj09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQogICAgICAg
ICAgICAgICAgICAgICAgICAgICBWVUxORVJBQklMSVRZIFNVTU1BUlkKClZVTE5FUkFCSUxJVFk6
ICAgIEJ1ZmZlciBvdmVmbG93IHZ1bG5lcmFiaWxpdHkgaW4gQ0RFIER0U3ZjIGxpYnJhcnkKClBM
QVRGT1JNUzogICAgICAgIElCTSBBSVggNC4zIGFuZCA1LjEKClNPTFVUSU9OOiAgICAgICAgIEFw
cGx5IHRoZSBlbWVyZ2VuY3ktZml4ZXMgZGVzY3JpYmVkIGJlbG93CgpUSFJFQVQ6ICAgICAgICAg
ICBNYWxpY2lvdXMgdXNlciBjYW4gb2J0YWluIGVsZXZhdGVkIHByaXZpbGVnZXMKCkNFUlQgQWR2
aXNvcnk6ICAgIE5PTkUKCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQogICAgICAgICAgICAgICAgICAgICAg
ICAgICBERVRBSUxFRCBJTkZPUk1BVElPTgoKSS4gIERlc2NyaXB0aW9uCgpBIGJ1ZmZlciBvdmVy
ZmxvdyB2dWxuZXJhYmlsaXR5IGhhcyBiZWVuIGZvdW5kIGluIHRoZSBDb21tb24gRGVza3RvcApF
bnZpcm9ubWVudCAoQ0RFKSBsaWJEdFN2Yy5hIGxpYnJhcnkuCgpUaGUgdnVsbmVyYWJpbGl0eSBp
cyBpbnZva2VkIHdoZW4gYSB1c2VyIHBhc3NlcyBhIHByb3Blcmx5IGNvZGVkIHN0cmluZyB0byBh
bnkKb2YgdGhlICJkdCIgY29tbWFuZHMgKGUuZy4sIGR0cHJpbnRpbmZvIGFuZCBkdHRlcm0pIHVz
aW5nIHRoZSAiLXNlc3Npb24iCm9wdGlvbi4KCgpJSS4gSW1wYWN0CgpBIG1hbGljaW91cyBsb2Nh
bCB1c2VyIGNhbiB1c2UgYSB3ZWxsLWNyYWZ0ZWQgZXhwbG9pdCBjb2RlIHRvIGdhaW4gZWxldmF0
ZWQsCnBvc3NpYmx5IHJvb3QsIHByaXZpbGVnZXMgb24gdGhlIGF0dGFja2VkIHN5c3RlbSwgY29t
cHJvbWlzaW5nIHRoZSBpbnRlZ3JpdHkgb2YKdGhlIHN5c3RlbSBhbmQgaXRzIGF0dGFjaGVkIGxv
Y2FsIG5ldHdvcmsuCgpUaGUgZXhwbG9pdGFiaWxpdHkgb2YgdGhpcyB2dWxuZXJhYmlsaXR5IGhh
cyBub3QgYmVlbiBzdHVkaWVkIGNvbXBsZXRlbHkuCk5vbmV0aGVsZXNzLCBBSVggc3lzdGVtIGFk
bWluaXN0cmF0b3JzIGFuZCBzZWN1cml0eSBwZXJzb25uZWwgYXJlIHVyZ2VkIHRvCmFwcGx5IHRo
ZSBlbWVyZ2VuY3kgcGF0Y2hlcyBiZWluZyBtYWRlIGF2YWlsYWJsZSB0byBwcmVjbHVkZSBhIHBv
c3NpYmx5IHNlcmlvdXMKYXR0YWNrLgoKSUlJLiAgU29sdXRpb25zCgogIEEuICBPZmZpY2lhbCBm
aXgKCklCTSBpcyB3b3JraW5nIG9uIHRoZSBmb2xsb3dpbmcgZml4ZXMgd2hpY2ggd2lsbCBiZSBh
dmFpbGFibGUgc29vbjoKCkFJWCA1LjE6ICBQZW5kaW5nIGFzc2lnbm1lbnQgLSB0aGUgUkVBRE1F
IGZpbGUgaW4gdGhlIGVmaXggZG93bmxvYWQgZGlyZWN0b3J5CndpbGwgYmUgdXBkYXRlZCBhcyBz
b29uIGFzIHRoZSBhc3NpZ25tZW50IGlzIG1hZGUuCgpBSVggNC4zOiAgQVBBUiAjSVkyNDU5NgoK
VGhlIEFQQVJzIGZvciBBSVggNC4zIGFuZCA1LjEgd2lsbCBub3QgYmUgYXZhaWxhYmxlIHVudGls
IGxhdGUgTm92ZW1iZXIgMjAwMS4KCk5PVEU6IEZpeCB3aWxsIG5vdCBiZSBwcm92aWRlZCBmb3Ig
dmVyc2lvbnMgcHJpb3IgdG8gNC4zIGFzIHRoZXNlIGFyZSBubyBsb25nZXIKc3VwcG9ydGVkIGJ5
IElCTS4gQWZmZWN0ZWQgY3VzdG9tZXJzIGFyZSB1cmdlZCB0byB1cGdyYWRlIHRvIDQuMy4zIGF0
IHRoZQpsYXRlc3QgbWFpbnRlbmFuY2UgbGV2ZWwsIG9yIHRvIDUuMS4KCgogIEIuICBIb3cgdG8g
bWluaW1pemUgdGhlIHZ1bG5lcmFiaWxpdHkKCgpXT1JLQVJPVU5ECgpOb25lLCBvdGhlciB0aGFu
IGRpc2FibGluZyB0aGUgQ0RFLiAKCkVNRVJHRU5DWSBGSVggKGVmaXgpOgoKVGVtcG9yYXJ5IGZp
eGVzIGZvciBBSVggNC4zLnggYW5kIDUuMSBzeXN0ZW1zIGFyZSBhdmFpbGFibGUuCgpUaGUgdGVt
cG9yYXJ5IGZpeGVzIGNhbiBiZSBkb3dubG9hZGVkIHZpYSBmdHAgZnJvbToKCmZ0cDovL2FpeC5z
b2Z0d2FyZS5pYm0uY29tL2FpeC9lZml4ZXMvc2VjdXJpdHkKClRoZSBuYW1lIG9mIHRoZSBlZml4
IHlvdSB3YW50IHRvIGRvd25sb2FkIHRvIGNsb3NlIHRoaXMgdnVsbmVyYWJpbGl0eSBpcwpDREVf
bGliRHRTdmNfZWZpeC50YXIuWi4KClRoZSBlZml4IGNvbXByZXNzZWQgdGFyYmFsbCBjb250YWlu
cyBhIGNvcHkgb2YgdGhpcyBBZHZpc29yeSBhbmQgYW5vdGhlcgp0YXJmaWxlLCBlZml4X2JpbmFy
aWVzLnRhci4gVGhpcyBsYXR0ZXIgdGFyZmlsZSB3aWxsIHVudGFyIGludG8gdHdvIGJpbmFyeSBl
Zml4CmZpbGVzLCBsaWJEdFN2Yy5hXzQzIGFuZCBsaWJEdFN2Yy5hXzUxLCBmb3IgQUlYIDQuMyBh
bmQgNS4xLCByZXNwZWN0aXZlbHkuIEluCmFkZGl0aW9uLCB0aGVyZSBpcyBhIGRldGFjaGVkIFBH
UCBzaWduYXR1cmUgZmlsZSBmb3IgZWZpeF9iaW5hcmllcy50YXIuIFRoZQpwcm9wZXIgc2lnbmF0
dXJlIGlzIHRoYXQgb2YgQUlYIFNlY3VyaXR5IDxzZWN1cml0eS1hbGVydEBhdXN0aW4uaWJtLmNv
bT4uCgpUaGVzZSB0ZW1wb3JhcnkgZml4ZXMgaGF2ZSBub3QgYmVlbiBmdWxseSByZWdyZXNzaW9u
IHRlc3RlZDsgdGh1cywKSUJNIGRvZXMgbm90IHdhcnJhbnQgdGhlIGZ1bGx5IGNvcnJlY3QgZnVu
Y3Rpb25pbmcgb2YgdGhlIGVmaXguCkN1c3RvbWVycyBpbnN0YWxsIHRoZSBlZml4IGFuZCBvcGVy
YXRlIHRoZSBtb2RpZmllZCB2ZXJzaW9uIG9mIEFJWAphdCB0aGVpciBvd24gcmlzay4KClRvIHBy
b2NlZWQgd2l0aCBlZml4IGluc3RhbGxhdGlvbjoKCkZpcnN0LCB2ZXJpZnkgdGhlIE1ENSBjcnlw
dG9ncmFwaGljIGhhc2ggc3VtIG9mIGVmaXhfYmluYXJpZXMudGFyIHlvdSBvYnRhaW4KZnJvbSB1
bnBhY2tpbmcgdGhlIGRvd25sb2FkZWQgY29tcHJlc3NlZCB0YXJiYWxsIHdpdGggdGhhdCBnaXZl
biBiZWxvdy4gVGhlc2UKc2hvdWxkIG1hdGNoIGV4YWN0bHk7IGlmIHRoZXkgZG8gbm90LCBkb3Vi
bGUgY2hlY2sgdGhlIGhhc2ggcmVzdWx0cyBhbmQgdGhlCmRvd25sb2FkIHNpdGUgYWRkcmVzcy4g
SWYgT0ssIGNvbnRhY3QgSUJNIEFJWCBTZWN1cml0eSBhdApzZWN1cml0eS1hbGVydEBhdXN0aW4u
aWJtLmNvbSBhbmQgZGVzY3JpYmUgdGhlIGRpc2NyZXBhbmN5LiAgQWxzbywgZm9yIHRob3NlCndo
byB1c2UgUEdQLCBhbm90aGVyIHNlY3VyaXR5IGNoZWNrIGZvciB0aGUgaW50ZWdyaXR5IG9mIHRo
ZSBlZml4IGJpbmFyaWVzCnRhcmZpbGUgaXMgdGhlIGluY2x1c2lvbiBvZiBhIGRldGFjaGVkIFBH
UCBzaWduYXR1cmUgZmlsZSwKZWZpeF9iaW5hcmllcy50YXIuYXNjLgoKTUQ1IChlZml4X2JpbmFy
aWVzLnRhcikgPSAzMWRiOTcxM2JhNWE2YTkxOWNjODgyYzdhMDUyNTIxNwoKSU1QT1JUQU5UIE5P
VEUgUkVHQVJESU5HIE1ENToKIk1ENSIgaXMgIk1lc3NhZ2UgRGlnZXN0ICM1Ii4gTUQ1IGlzIGEg
MTI4LWJpdCBvbmUtd2F5IGNyeXB0b2dyYXBoaWMgaGFzaAphbGdvcml0aG0uICBJdCBpcyB1c2Vk
IHRvIGdlbmVyYXRlIGEgY3J5cHRvLXNlY3VyZSAic2lnbmF0dXJlIiBvciAiZmluZ2VycHJpbnQi
Cm9mIGEgZmlsZSBvciBhIGRpcmVjdG9yeSBhbmQgaXRzIGZpbGVzLiBBbHRob3VnaCBub3QgMTAw
JSBpbmZhbGxpYmxlLCBNRDUgaXMKbWVhbnQgdG8gYmUgdXNlZCB0byBnZW5lcmF0ZSB0aGUgc2Vj
dXJlLCB1bmlxdWUgZmluZ2VycHJpbnQgb2YgYQpmaWxlL2RpcmVjdG9yeSwgYW5kIGFsc28gdG8g
Z2VuZXJhdGUgc3VjaCBhIGZpbmdlcnByaW50IG9mIGEgZmlsZS9kaXJlY3RvcnkgZm9yCmNvbXBh
cmlzb24gd2l0aCBzb21lb25lIGVsc2UncyBNRDUgZmluZ2VycHJpbnQgb2YgdGhhdCBmaWxlL2Rp
cmVjdG9yeS4gSWYgdGhlCmZpbmdlcnByaW50cyBtYXRjaCwgdGhlbiB0aGUgZmlsZS9kaXJlY3Rv
cnkgYmVpbmcgZXhhbWluZWQgaGFzIG5vdCBiZWVuCm1vZGlmaWVkIG9yIHJlcGxhY2VkIHdpdGgg
YW5vdGhlci4gVGh1cywgb25lIGNhbiBiZSByZWFzb25hYmx5IGNlcnRhaW4gdGhhdCB0aGUKZmls
ZSBvciBmaWxlc2V0IGlzIHRoZSBvbmUgb3JpZ2luYWxseSBjcmVhdGVkIGJ5IGEga25vd24sIHRy
dXN0ZWQgZW50aXR5LCBhbmQKcGFzc2VkIHRvIHRoZSBpbnRlbmRlZCBwZXJzb24gb3IgcGVvcGxl
LgoKU291cmNlIGNvZGUgZm9yIE1ENSBjYW4gYmUgb2J0YWluZWQgYXQ6CmZ0cDovL2Z0cC5mdW5l
dC5maS9wdWIvY3J5cHQvaGFzaC9tZHMvbWQ1IEN1c3RvbWVycyBzaG91bGQgZG93bmxvYWQKbWQ1
c3VtLnRhci5neiBhbmQgdGhlIE1ha2VmaWxlLCBhbmQgdGhlbiBjb21waWxlIHRvIG1ha2UgdGhl
IGV4ZWN1dGFibGUuCgpUbyBnZW5lcmF0ZSB0aGUgaGFzaCBzaWduYXR1cmUgb2YgYSBmaWxlIG9y
IGZpbGVzZXQsIGVudGVyIG9uIHRoZSBjb21tYW5kIGxpbmUKdGhlIG5hbWUgb2YgdGhlIE1ENSBl
eGVjdXRhYmxlIGZvbGxvd2VkIGJ5IHRoZSBuYW1lIG9mIHRoZSBmaWxlL2RpcmVjdG9yeSBvZgpp
bnRlcmVzdC4KClRoZW4gY29tcGFyZSB0aGUgb3V0cHV0IGhhc2ggd2l0aCB0aGF0IGdpdmVuIGFi
b3ZlLgoKRmluYWxseSwgdGhlIHVzZSBvZiBNRDUsIG9yIG5vdCB1c2luZyBpdCwgZG9lcyBub3Qg
YWZmZWN0IGluIGFueSB3YXkgdGhlCmluc3RhbGxhdGlvbiBvZiB0aGUgZWZpeC4gSXQgaXMgbWVh
bnQgdG8gYmUgYSBzZWN1cml0eSBtZWFzdXJlIG9ubHkuCgogICAgZWZpeCBJbnN0YWxsYXRpb24g
SW5zdHJ1Y3Rpb25zOgogICAgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKMS4gQmVj
b21lIHJvb3QsIGlmIG5vdCBhbHJlYWR5IGRvbmUuIAoKMi4gSW4gdGhlIC90bXAgZGlyZWN0b3J5
LCB1bmNvbXByZXNzIGFuZCB1bnRhciB0aGUgZWZpeDoKCiAgICAgICBhLiB1bmNvbXByZXNzIENE
RV9saWJEdFN2Y19lZml4LnRhci5aCiAgICAgICBiLiB0YXIgLXh2ZiBlZml4X2JpbmFyaWVzLnRh
cgoKWW91IHdpbGwgbm93IGhhdmUgdHdvIGJpbmFyeSBlZml4IGZpbGVzOiBsaWJEdFN2Yy5hXzQz
IGFuZCBsaWJEdFN2Yy5hXzUxLCBvbmUKZm9yIEFJWCA0LjMgYW5kIHRoZSBvdGhlciBmb3IgQUlY
IDUuMSwgcmVzcGVjdGl2ZWx5LiAgWW91IHdpbGwgYWxzbyBoYXZlIGEKUEdQLXNpZ25lZCBjb3B5
IG9mIHRoaXMgYWR2aXNvcnksIG5hbWVkICJBZHZpc29yeSIuICBUaGVyZSBpcyBhbHNvIGEgZGV0
YWNoZWQKUEdQIHNpZ25hdHVyZSBvZiB0aGUgZWZpeF9iaW5hcmllcy50YXIgZmlsZS4gIFRoZSBz
aWduYXR1cmUgc2hvdWxkIGJlIHRoYXQgb2YKQUlYIFNlY3VyaXR5IDxzZWN1cml0eS1hbGVydEBh
dXN0aW4uaWJtLmNvbT4uCgpLZWVwIHRoZSBiaW5hcnkgZmlsZSBjb250YWluaW5nIHRoZSBwYXRj
aCBmb3IgeW91ciB2ZXJzaW9uCm9mIEFJWC4gWW91IG1heSBkaXNjYXJkIHRoZSB1bm5lZWRlZCBv
bmUgaWYgeW91IGRlc2lyZS4KCk5vdyBleGVjdXRlOgpjcCBsaWJEdFN2Yy5hX3h5IGxpYkR0U3Zj
LmEgIC8qIHdoZXJlICJ4eSIgaXMgZWl0aGVyICI0MyIgb3IgIjUxIiBhcwphcHByb3ByaWF0ZSAq
LwoKMy4gRm9sbG93IHRoZXNlIGluc3RydWN0aW9uczoKClRvIGluc3RhbGwgbGliRHRTdmMuYSA6
CgpjZCAvdXNyL2R0L2xpYgptdiBsaWJEdFN2Yy5hIGxpYkR0U3ZjLmEub3JpZyAgLyogbWFrZSBh
IGJhY2t1cCBvZiB5b3VyIG9yaWdpbmFsIGxpYkR0U3ZjLmEhICovCm12IC90bXAvbGliRHRTdmMu
YSAuICAgLyogVGhlIG5ldyBsaWJEdFN2Yy5hICovCmNobW9kIDQ0NCBsaWJEdFN2Yy5hCmNob3du
IGJpbjpiaW4gbGliRHRTdmMuYQpzbGliY2xlYW4KCgpJVi4gT2J0YWluaW5nIEZpeGVzCgpJQk0g
QUlYIEFQQVJzIG1heSBiZSBvcmRlcmVkIHVzaW5nIEVsZWN0cm9uaWMgRml4IERpc3RyaWJ1dGlv
biAodmlhIHRoZSBGaXhEaXN0CnByb2dyYW0pLCBvciBmcm9tIHRoZSBJQk0gU3VwcG9ydCBDZW50
ZXIuICBGb3IgbW9yZSBpbmZvcm1hdGlvbiBvbiBGaXhEaXN0LCBhbmQKdG8gb2J0YWluIGZpeGVz
IHZpYSB0aGUgSW50ZXJuZXQsIHBsZWFzZSByZWZlcmVuY2UKCiAgICAgICAgaHR0cDovL3RlY2hz
dXBwb3J0LnNlcnZpY2VzLmlibS5jb20vcnM2ay9maXhlcy5odG1sCgpvciBzZW5kIGVtYWlsIHRv
ICJhaXhzZXJ2QGF1c3Rpbi5pYm0uY29tIiB3aXRoIHRoZSB3b3JkICJGaXhEaXN0IiBpbiB0aGUK
IlN1YmplY3Q6IiBsaW5lLgoKVG8gZmFjaWxpdGF0ZSBlYXNlIG9mIG9yZGVyaW5nIGFsbCBzZWN1
cml0eSByZWxhdGVkIEFQQVJzIGZvciBlYWNoIEFJWCByZWxlYXNlLApzZWN1cml0eSBmaXhlcyBh
cmUgcGVyaW9kaWNhbGx5IGJ1bmRsZWQgaW50byBhIGN1bXVsYXRpdmUgQVBBUi4gIEZvciBtb3Jl
CmluZm9ybWF0aW9uIG9uIHRoZXNlIGN1bXVsYXRpdmUgQVBBUnMgaW5jbHVkaW5nIGxhc3QgdXBk
YXRlIGFuZCBsaXN0IG9mCmluZGl2aWR1YWwgZml4ZXMsIHNlbmQgZW1haWwgdG8gImFpeHNlcnZA
YXVzdGluLmlibS5jb20iIHdpdGggdGhlIHdvcmQKInN1YnNjcmliZSBTZWN1cml0eV9BUEFScyIg
aW4gdGhlICJTdWJqZWN0OiIgbGluZS4KCgpWLiAgQWNrbm93bGVkZ2VtZW50cwoKTWFueSB0aGFu
a3MgdG8gQXJhaSBZdXUsIG9mIHRoZSBMQUMgQ29tcHV0ZXIgU2VjdXJpdHkgTGFib3JhdG9yeSBp
biBKYXBhbiBmb3IKZGlzY292ZXJpbmcgdGhpcyB2dWxuZXJhYmlsaXR5IQoKVkkuICBDb250YWN0
IEluZm9ybWF0aW9uCgpDb21tZW50cyByZWdhcmRpbmcgdGhlIGNvbnRlbnQgb2YgdGhpcyBhbm5v
dW5jZW1lbnQgY2FuIGJlIGRpcmVjdGVkIHRvOgoKICAgc2VjdXJpdHktYWxlcnRAYXVzdGluLmli
bS5jb20KClRvIHJlcXVlc3QgdGhlIFBHUCBwdWJsaWMga2V5IHRoYXQgY2FuIGJlIHVzZWQgdG8g
ZW5jcnlwdCBuZXcgQUlYIHNlY3VyaXR5CnZ1bG5lcmFiaWxpdGllcywgc2VuZCBlbWFpbCB0byBz
ZWN1cml0eS1hbGVydEBhdXN0aW4uaWJtLmNvbSB3aXRoIGEgc3ViamVjdCBvZgoiZ2V0IGtleSIu
CgpJZiB5b3Ugd291bGQgbGlrZSB0byBzdWJzY3JpYmUgdG8gdGhlIEFJWCBzZWN1cml0eSBuZXdz
bGV0dGVyLCBzZW5kIGEgbm90ZSB0bwphaXhzZXJ2QGF1c3Rpbi5pYm0uY29tIHdpdGggYSBzdWJq
ZWN0IG9mICJzdWJzY3JpYmUgU2VjdXJpdHkiLiAgVG8gY2FuY2VsIHlvdXIKc3Vic2NyaXB0aW9u
LCB1c2UgYSBzdWJqZWN0IG9mICJ1bnN1YnNjcmliZSBTZWN1cml0eSIuICBUbyBzZWUgYSBsaXN0
IG9mIG90aGVyCmF2YWlsYWJsZSBzdWJzY3JpcHRpb25zLCB1c2UgYSBzdWJqZWN0IG9mICJoZWxw
Ii4KCklCTSBhbmQgQUlYIGFyZSBhIHJlZ2lzdGVyZWQgdHJhZGVtYXJrIG9mIEludGVybmF0aW9u
YWwgQnVzaW5lc3MgTWFjaGluZXMKQ29ycG9yYXRpb24uICBBbGwgb3RoZXIgdHJhZGVtYXJrcyBh
cmUgcHJvcGVydHkgb2YgdGhlaXIgcmVzcGVjdGl2ZSBob2xkZXJzLgoKCi0tLS0tQkVHSU4gUEdQ
IFNJR05BVFVSRS0tLS0tClZlcnNpb246IFBHUCA2LjUuMgoKaVFDVkF3VUJPOTNNdFFzUGJhTDFZ
Z3F2QVFIbFBRUDlHYzYxdCtDTTRsdllHNG1MR0UxYUVwODNIb2RlRFpocwoxd2VkckFTUTB2ODhN
TkpoK05PMnlCYkdzWnhNd3NtMG9yTjFhR2ZXWFk5dXZOd0plS1V4V2N6dmU2Yi81WmwvCmk0UVFj
WjVBbjJjeVdqYzV0TU9LM212KzhMeldyYjdEZ0JNVVZNSE9DaEpNVzlhaHB0ZkxwMHJNUWJ6Vlhv
aUEKeFY5UFRnR0ZYbEU9Cj1tVXdyCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo=

--0__=85256AF50001FFE48f9e8a93df938690918c85256AF50001FFE4--