************************************************************************** Security Bulletin 9622 DISA Defense Communications System October 16, 1996 Published by: DISN Security Coordination Center (SCC@NIC.DDN.MIL) 1-(800) 365-3642 DEFENSE INFORMATION SYSTEM NETWORK SECURITY BULLETIN The DISN SECURITY BULLETIN is distributed by the DISN SCC (Security Coordination Center) under DISA contract as a means of communicating information on network and host security exposures, fixes, and concerns to security and management personnel at DISN facilities. Back issues may be obtained via FTP (or Kermit) from NIC.DDN.MIL [192.112.36.5] using login="anonymous" and password="guest". The bulletin pathname is scc/sec-yynn (where "yy" is the year the bulletin is issued and "nn" is a bulletin number, e.g. scc/sec-9544.txt). These are also available at our WWW site, http://nic.ddn.mil. ************************************************************************** + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + ! ! ! The following important advisory was issued by the Automated ! ! Systems Security Incident Support Team (ASSIST) and is being ! ! relayed unedited via the Defense Information Systems Agency's ! ! Security Coordination Center distribution system as a means ! ! of providing DISN subscribers with useful security information. ! ! ! + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + -----BEGIN PGP SIGNED MESSAGE----- <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Automated Systems Security Incident Support Team _____ ___ ___ _____ ___ _____ | / /\ / \ / \ | / \ | | / Integritas / \ \___ \___ | \___ | | < et /____\ \ \ | \ | | \ Celeritas / \ \___/ \___/ __|__ \___/ | |_____\ <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Bulletin 96-20 Release date: October 15, 1996, 11:30 AM EDT (GMT -4) SUBJECT: CERT and SGI bulletins on expreserve vulnerability SUMMARY: Expreserve is a utility that preserves the state of a file being edited by vi(1) or ex(1) when an edit session terminates abnormally or when the system crashes. Expreserve has a vulnerability that allows users to overwrite any file on the system. Exploitation scripts are publicly available. BACKGROUND: ASSIST has been informed that many users have still not patched the expreserve vulnerability. Assist recommends that you patch your system as soon as possible. The CERT bulletin below details how to find the proper patch for your system. Until you can install a patch, you should apply the workaround as described in Section III below. The expreserve vulnerability applies to many UNIX platforms. Please see the vendor information in the bulletin below for specific platform information. IMPACT: By exploiting this vulnerability, users with access to an account on the system can readily gain root privileges. RECOMMENDED SOLUTIONS: See bulletins below. ----------------------------------------------------------------------------------------- ============================================================================= CERT(sm) Advisory CA-96.19 August 15, 1996 Topic: Vulnerability in expreserve - - ----------------------------------------------------------------------------- *** This advisory supersedes CA-93:09 and CA-93:09a. *** The CERT Coordination Center has received reports of a vulnerability in expreserve. Though this is not a new vulnerability, it is one that is widely known and that many users have not yet patched. The CERT/CC team recommends that you patch your system as soon as possible, as exploitation scripts are publicly available. Appendix A contains the information we have received from vendors. Until you can install a patch, you should apply the workaround in Section III below. As we receive additional information relating to this advisory, we will place it in ftp://info.cert.org/pub/cert_advisories/CA-96.19.README We encourage you to check our README files regularly for updates on advisories that relate to your site. - - - - - ----------------------------------------------------------------------------- I. Description Expreserve is a utility that preserves the state of a file being edited by vi(1) or ex(1) when an edit session terminates abnormally or when the system crashes. Expreserve has a vulnerability that allows users to overwrite any file on the system. Exploitation scripts are publicly available. II. Impact By exploiting this vulnerability, users with access to an account on the system can readily gain root privileges. III. Solution A. Apply a patch or workaround provided by your vendor. Below is a summary list of the vendors who have provided information, which we have placed in Appendix A of this advisory. If your vendor's name is not on this list, please contact the vendor directly. Berkeley Software Design, Inc. Cray Research Data General Corporation Digital Equipment Corporation Hewlett-Packard Company IBM Corporation NeXT Software, Inc. Open Software Foundation The Santa Cruz Operation, Inc. Sun Microsystems, Inc. B. Until you are able to apply a patch or workaround, we recommend that you remove the execute permissions on the existing /usr/lib/expreserve program. Do this as root: % /usr/bin/chmod a-x /usr/lib/expreserve This workaround disables expreserve functionality. The result of this workaround is that if vi(1) or ex(1) is running, and the sessions are interrupted, the files being edited will not be preserved and all edits not explicitly saved by the users will be lost. Encourage users to save their files often. ......................................................................... Appendix A: Vendor Information Current as of August 15, 1996 See CA-96.19.README for updated information. Below is information we have received from vendors concerning the vulnerability described in this advisory. If you do not see your vendor's name, please contact the vendor directly for information. Berkeley Software Design, Inc. ============================== BSD/OS is not vulnerable to this problem. We ship the current Keith Bostic nvi which does not use the old expreserve scheme to save files (it uses the 4.4BSD-style 1777 tmp directories to store user tmp files in /var/tmp owned by the user and therefore doesn't require a setuid scheme to recover them). Cray Research ============= We have fixed this problem at Cray Research in Unicos version 7.0. Data General Corporation ======================== The binary /usr/lib/expreserve is not a setuid program on DG/UX, any flavor. We are not, therefore, vulnerable to the exploitation described. Nevertheless, the suggested change has been made and will be included in subsequent releases of DG/UX. Digital Equipment Corporation ============================= This reported problem is not present for Digital's ULTRIX or Digital UNIX Operating Systems Software. Source: Digital Equipment Corporation Software Security Response Team Copyright (c) Digital Equipment Corporation 1996. All rights reserved. 8/13/96 - DIGITAL EQUIPMENT CORPORATION Hewlett-Packard Company ======================= Hewlett-Packard recommends that all customers concerned with the security of their HP-UX systems either apply the appropriate patch or perform the actions described below as soon as possible. The vulnerability can be eliminated from releases 9.X of HP-UX by applying a patch: Apply patch PHCO_6363 (series 700/800, HP-UX 9.x), or PHCO_7833 (series 300/400, HP-UX 9.x), or perform the actions described below in releases of HP-UX prior to 9.X, and in 10.X) Since some patches will not be made available on some releases of HP-UX (e.g., prior to 9.X, and now 10.0X), affected systems can be protected by system administrators. They should: $ su root # chmod 0555 /usr/lib/expreserve In the case of 10.X systems execute the following to affect the link target: $ su root # chmod 0555 /usr/lbin/expreserve The default permission for the file /usr/lib/expreserve (or on HP-UX 10.X /usr/lbin/expreserve) needs only minimal privileges. If the patches mentioned above are applied the vulnerability cannot be exploited. Hewlett-Packard Security Bulletin #HPSBUX9607-033, dated July 18, 1996 contains more details. This bulletin is available from http://us.external.hp.com/news/ ftp://info.cert.org/pub/vendors/hp/ IBM Corporation =============== AIX versions 3.2.5, 4.1, and 4.2 are not vulnerable to this particular problem. IBM and AIX are registered trademarks of International Business Machines Corporation. NeXT Software, Inc. =================== This problem was fixed in or before release 3.3 of NeXTstep. Open Software Foundation ======================== OSF's OSF/1 R1.3 is not effected by this vulnerability. The Santa Cruz Operation, Inc. ============================== SCO Operating Systems are not vulnerable to this problem. Sun Microsystems, Inc. ====================== Sun Microsystems, Inc. ====================== System Patch ID Filename MD5 Checksum - - - ------ -------- --------------- ----------- SunOS 101080-01 101080-01.tar.Z 53c8a5c4eee770924560c5fc100542a3 Solaris 2.0 101119-01 101119-01.tar.Z No longer available Solaris 2.1 101089-01 101089-01.tar.Z No longer available Solaris 2.2 101090-01 101090-01.tar.Z e9ff98823abbc75d95410a0cb7856644 Solaris 2.3 Solaris 2.4 102756-01 102756-01.tar.Z 61f4a48ddba41ae1c27e70b84f4c8d87 Solaris 2.4_x86 102757-01 102757-01.tar.Z 1f2b7f3824565ef849eb3c4677567399 - - --------------------------------------------------------------------------- End of CERT bulletin Beginning of SGI bulletin - - --------------------------------------------------------------------------- ________________________________________________ Silicon Graphics Inc. Security Advisory Title: Vulnerability in expreserve Title: CERT(sm) Advisory CA-96.19 Number: 19960802-01-I Date: October 23, 1996 ______________________________________________________________________________ Silicon Graphics provides this information freely to the SGI user community for its consideration, interpretation, implementation and use. Silicon Graphics recommends that this information be acted upon as soon as possible. Silicon Graphics will not be liable for any indirect, special, or consequential damages arising from the use of, failure to use or improper use of any of the instructions or information in this Security Advisory. ______________________________________________________________________________ - - - ------------------- - - - --- Description --- - - - ------------------- In CERT(sm) Advisory CA-96.19, titled "Vulnerability in expreserve", a security vulnerability in the expreserve program is discussed. According to the CERT(sm) advisory, the expreserve program has setuid root privileges which creates a vulnerability that allows users to overwrite any file on the system. - - - -------------- - - - --- Impact --- - - - -------------- As reported by the CERT(sm) Advisory, when exploited, this vulnerability could allow users with access to an account on the system to gain root privileges. Impact for Silicon Graphics IRIX systems is different and very limited, see "Solution" section. - - - ---------------- - - - --- Solution --- - - - ---------------- SGI has investigated the expreserve issue and provides the following information. The Silicon Graphics implementation of expreserv is setgid sys and not setuid root as reported in the CERT(sm) advisory. As such this redefines the exposure to a setgid sys issue. Exploit would have to occur on group sys writable files, however, on a default configured IRIX system there are no system critical files that are group sys writable and therefore exposure and exploit does not exist. Silicon Graphics will not be releasing a patch for this issue, however, the issue will be corrected in future releases of IRIX. If desired, the setgid permission of the expreserv could be removed however, this will disable the recovery functions of the vi(1) and ex(1) editors. This functionality could be fixed by manually creating directories for each user in /var/preserve directory. - - ------------------------------------------------------------------ End of SGI bulletin - - ------------------------------------------------------------------ <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ASSIST would like to thank CERT and SGI for the information contained in these bulletins. <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi4uZ40AAAEEAM1uraimCNeh5PtzX7KoGxC2u8uMTdl8V5sujk3MHbWvCuOM W0FqDy5s9iwfQLZWzJ7cbM6L0mNOj8eJGoz7TqGKZDDRFlKAwg0x8joleZLC2gXw FVdF/g6Mdv7ok7heoa+Y//YMeADnsSrmzqLCnhFbKYffww3EbdH6sbnW3Io9AAUR tB9BU1NJU1QgVGVhbSA8YXNzaXN0QGFzc2lzdC5taWw+iQCVAwUQMJVF1JtBJ/Qs yeedAQFnqgQAp1rw7ONT41Mr3gHGs2aVpEwgOH6SeJ9sHZxUp4dJu+ogRMFrqdC+ +NBfzitzj9m1udFVDHpwsGawbv6wg43DDAKaTgIETCHYXa/OM5/9FCS3xJwC99Gb V1iOm8S/Q9FcJruKID9DG2WUJp2yPj+CjTuBQeLjGkqGjuSOR1TNXQiJAJUDBRAw lUPuYKf6jFkmJQkBAWg5A/9ykgo2ULWUsSzZjRkO9yPZUPAlpfH7ReaHwkapK69F fBzqwwQ8Gig1mL+qgmOHS8Zv+OAT491sWWsECN+dfpopFdsgS4Sec19ZjcMyhL1c BVIS9Cmbjetb6Kvfc39AMr0MRCrUlOkUd4qScjHysHFYRAwCl3STRjprNnUPKQbn f4kAlQMFEDB482bk8movIjSrbQEB/VgD/iap/CAb1jq8wMA3QleU8d6/QUqoPzgp jRhP0wP7K2GLVUV0d5sP4EptmzejqViZvlzt6ufnI1bML0Yt2U5loAeblnh714RX JcOmyAah6niiJSKuhCsYUzW6f3EBzXBn5tcu3GP35h+1VQunCQCMICCfnZ0r8Wcv EdwE9LxPYdueiQCVAwUQMHOjMwJPhGsUbeKNAQGOagQAgT5p6CwrIPpi+12yJ170 ekc3MPp8z0aNbvdCQWXTK6qtq1LmS65VeH0RE5xRponsgbWp+5JBvD22v0eGuSg7 7bnHT1HPXazPERAp8sw1zTERs7drMQE+JhHYylh3orKzHNf5EjFx10vwEXdfvGSc sP3Vpcx2xu0lUYHp5oHtPFiJAJUDBRAwar4DFKHh5Qavqe0BAeQqA/4xd0tdq9yF eUYrd1+ZriayzfSjCcIUlCDH1i7vXw1kiHkg2YpOoZLD9k+zNkbOyBs/r570fGHu A23SvUcUfaBUijT1jf9YGU5MQMdpx3p5qqI4kJ0GWUNySZNtaFy0qWNH8Z8NsNp3 FWllVeisye0qe96aoizW0dAyUymlM6YYn4kAlQMFEDBqqvga2zTcAviMgQEBN8wE AIu7O/Of4c1OvMc5tti4+gcyCVw41+fLjxQFB5EtkoW8Js6XhCsv3GcmzgCZw3g8 Sux7wxGe+lspZNV9rvv+JkDBWkA9O5HyOdmdv5JZM1UH41NettZM9Yw7kUtO7lAT aOb4ybHlqrBwJ8/+Lig7r7PwTL847JyGa3g229pGG/uEiQCVAwUQMGpTK+glSuMP TJd1AQE8KQP8Cu+FYuagNoBRllMIQryT9+0ngLRxJJTcTgIbLX4OPwa27JuXCukG kUIXRWFCqkRqkM/7ImZXeuUL4PmAX07f9ygGH7BUyqefhIWkxWFDaGHJVlg3l/pS Wh7NnC+nU6DUJNSzfwYStCABNptOcMiYaT1fY0+DkWpIgJVRTptquOWJAJUCBRAw aHX+IlGW2WZtAFEBATkXA/40QTxVP/x3aJDgC11cvFhwT7M+qJvhGSTRJOtrFz8i soZzihMeaQ8zLiu73dDlFz2E4f0+ettxsDcgFJADNmZ5H7WkPlf9gBUBne4KP2Y6 yIjOCMwd6T7HGm/ErF88DIJ2wn8irhzVRnBBWhnmQfSzr5a7mkjlA6GzAlFucGp3 eokAlQMFEDBpzIC58yc3bMt0GQEBgd4EAI0mE/5wXSWuBNApkALLjPAchBdeC4Kl YF4hQkfY/4YddeIasgTmINKOc5gJWgTHxPI2xKxjTAQhIZlOxuDyXWnBuK+x2hr4 iCh5unEIH+qaqdipGwWjFq0IZEmOOJaBRxlVt2hrmY6nRMpekitFLw8dhWHgI968 WVhJpWfBg+MhiQCVAwUQMGnMcmJl+kgHVnRVAQF+nQP/XK4xmIx1SmjoN9D+vNRY PSiKz8KEzh1Y2/5QTYA7iES8QXC4i/8HOWK7lyoL6FmWGxKYpU8isQ+DJpk0A4N0 U04JexpyFa0EeM/wsfp0YvAWesSVhV5UkDQU6hSC0U8rS1j/qtnSLZ4wXpapPSBh 82daDlxAQCVMzDoQYQZkMi+JAJUDBRAwacftBCZ9eY4KSdEBAbKGA/0VHArALL6v d0a0x7sn4o60Bk2fFzuaCBNTNzb11OOtuu47KMOZLwrl2jv+32ysIVEOXx+puhXP nQAgRrH0LGKV5FOY3B98AHuV+woOmfVjM2T3xB4Bs52Dz+HIIIhaWzzy3955tlp/ 6UyvZnD0QFLS/bre/Pog1Lgl0pxonmILhYkAlQIFEDBpJpXAx/wW8A8EIQEBPVoD /jwgG+7ZrWrb8/dqe6IZhSk8rq0JIHhSA2Hz1T7PhRvyDiquBJ3ulTeaX3BvuWqF bMuLJ4CTqXw9dexDehEnhGlxYycSXVzy8a34pLnmldii8oNvI1bLWMgd4HdM/PPZ GOgHmSIGrXMChkbddt9AoszDI0Whlbe9+wn6AeZVrJVaiQCVAgUQMGkkL2yh0IcG ee2RAQHrTgQAvBRce0S9yBvI/ufC/1jhE3LuUoA3YDdA8+UQ+UekaslZzOEgPs4K Za/nM9Y2vaRYscyzyIg8FGTzCdJQ2be9HZjSkB2xQuakeq88tlV32/cLcQSC8Zrw xsnPWujbIcWYg7B0hv8cCovef/w4kC9GyhjhIzPIsQ/Cr7/TYzheK12JAJUDBRAw Z/38o2xF3nu86kkBARanA/0XO4HBo6pT2xNCdQ7AW9UrvmTCiYUb0XVY7qCnkaPp Sn1KjsK2nGueDMGUBzvx9zWZ0xHAS+BSNkoM61gb9455KcbDwRqw6+47O/WuX1w9 fh7egjTY0kqN6YsP/vtirOuP+Krh19w/s6cDxbEBNbJIiZofRDFRRsZcZ8E2mLCP UIkAlQMFEDBn/EY7f8e8znZrHwEBxQwD/jP+CiwO3Nk45M5Ei++TZzdp7ak82hum XxVXplV2G4w8DN86pfl3IV/XvU67FQXg4NKJr+wm3JknDtlKZTE5g+aKkOYK6Fqt w3FjTd6PTDz11YRruCsdvBeYwMcHPe5XzIhgkwkMXX2Mp99q9LGKfV3087do2LNr V/2S/atn6IuqiQCVAwUQMGW6OliXq3zaXLJBAQFLwgP/bQ1C/Ph54RlRqw9rovJo SXp5wvQAfVqqnkL5nIIIK2uGputcmhMP8RqYKuRv4xaezkCDTeIE/P0327Ajc4// ca4SZCojxfqtrhw3EkfZtvFLJh1tsvAkqZkgHmjJxwA+lY78lQ1ncBZ99dePpuHu MBQew3769SkEA8kk/s5XiYqJAJUDBRAvXHHu0fqxudbcij0BAQFjA/0W8glucqO0 wtSPyCF3qGimFLHxZmd9Cw6Zlf8Ftfy8rPVrkGQGfioA29b64oZ1SUTwsswSbU8P n0KKFxvc6hYM5TzMg4gSu+vLh6pr4vMRdXyecF16z4BrUwIwZLP4rc5o/vyVDskI ahj1NdNYh6V8B0FUEbhVBxJBGfy2NF0bZ7QoQVNTSVNUIFRlYW0gPGFzc2lzdEBh c3Npc3QuaW1zLmRpc2EubWlsPokAlQIFEC45Ys3KbyuD/AwC1QEBKPED/2dwnN+/ OE2iHhvGwv3jZtsm6cH+GVkpNpc0w0vQOKvVwUnLwuETSv+eryz9Fl7nL0U2tv/5 V81dXqqc5C7EvOQW1Dt9RBSjEOundYrOzsfELIMrwh1iJXsIxG7g7iil0HeKzxsQ E/nBFwJbgP6SQaYF4wy7TPuXw+IVVddp0p1riQCVAgUQLi5x6IdGPdIwvm+pAQFN EwP+Ml0i+yurXH1ZvQApz+HKwqLrRTNsNdHu2CsQ/OdGo4Vq4eqyPTvrI1OVjm6o jye7GR3RMPygEcz0oox/+YfB5cmGugpZLFsWLspswrFGGCXLXY3Bq7mpH14GENU5 JMlHzazeRvdDbkSv700Xu25JshjWIzfTY2nNUNfFlRefQoY= =8gi/ - - -----END PGP PUBLIC KEY BLOCK----- ASSIST is an element of the Defense Information Systems Agency (DISA), and provides service to the entire DoD community. Constituents of the DoD with questions about ASSIST or computer security issues, can contact ASSIST using one of the methods listed below. Non-DoD organizations/institutions, contact the Forum of Incident Response and Security Teams (FIRST) representative. To obtain a list of FIRST member organizations and their constituencies send an email to docserver@first.org with an empty "subject" line and a message body containing the line "send first-contacts". ASSIST Information Resources: To be included in the distribution list for the ASSIST bulletins, send your Milnet (Internet) e-mail address to assist-request@assist.mil. Back issues of ASSIST bulletins, and other security related information, are available from the ASSIST BBS at 703-607-4710, 327-4710, and through anonymous FTP from assist.mil (IP address 199.211.123.11). Note: assist.mil will only accept anonymous FTP connections from Milnet addresses that are registered with the NIC or DNS. If your system is not registered, you must provide your MILNET IP address to ASSIST before access can be provided. ASSIST Contact Information: PHONE: 800-357-4231, COMM 703-607-4700, DSN 327-4700. ELECTRONIC MAIL: assist@assist.mil. ASSIST BBS: COMM 703-607-4710, DSN 327-4710, leave a message for the "sysop". FAX: COMM 703-607-4735, DSN 607-4735 ASSIST uses Pretty Good Privacy (PGP) 2.6.2 as the digital signature mechanism for bulletins. PGP 2.6.2 incorporates the RSAREF(tm) Cryptographic Toolkit under license from RSA Data Security, Inc. A copy of that license is available via anonymous FTP from net-dist.mit.edu (IP 18.72.0.3) in the file /pub/PGP/rsalicen.txt, and through the world wide web from http://net-dist.mit.edu/pgp.html. In accordance with the terms of that license, PGP 2.6.2 may be used for non-commercial purposes only. Instructions for downloading the PGP 2.6.2 software can also be obtained from net-dist.mit.edu in the pub/PGP/README file. PGP 2.6.2 and RSAREF may be subject to the export control laws of the United States of America as implemented by the United States Department of State Office of Defense Trade Controls. The PGP signature information will be attached to the end of ASSIST bulletins. Reference herein to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by ASSIST. The views and opinions of authors expressed herein shall not be used for advertising or product endorsement purposes. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMmOQkdH6sbnW3Io9AQE6KwQAg6mbjjDIDEdBYgnyxm/KZV+nfVwgwZ0Y IbUk+hPfK1TpSDEkVfbmhBkAyiiO4GEqB5hpJq9j6xAwiydVVZ/7X4ceERK5V06h j4FAYsKZ64G9zU/LuOnXFd0VepJKPXZs5JGZeOdcl/UInNSy0EtMb3zwRs/br7as cyd1uIhVGuo= =X3DF -----END PGP SIGNATURE----- **************************************************************************** * * * The point of contact for NIPRNET security-related incidents is the * * Security Coordination Center (SCC). * * * * E-mail address: SCC@NIC.DDN.MIL * * * * Telephone: 1-(800)-365-3642 * * * * NIC Help Desk personnel are available from 7:00 a.m.-7:00 p.m. EST, * * Monday through Friday except on federal holidays. * * * **************************************************************************** PLEASE NOTE: Some users outside of the DOD computing communities may receive DISN Security Bulletins. If you are not part of the DOD community, please contact your agency's incident response team to report incidents. Your agency's team will coordinate with DOD. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained by sending email to docserver@first.org with an empty subject line and a message body containing the line: send first-contacts. This document was prepared as an service to the DOD community. Neither the United States Government nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government. The opinions of the authors expressed herein do not necessarily state or reflect those of the United States Government, and shall not be used for advertising or product endorsement purposes.