295 lines
12 KiB
Plaintext
295 lines
12 KiB
Plaintext
|
|
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
CERT(sm) Advisory CA-94:09
|
|
Original issue date: May 23, 1994
|
|
Last revised: August 30, 1996
|
|
Information previously in the README was inserted into the
|
|
advisory.
|
|
|
|
A complete revision history is at the end of this file.
|
|
|
|
Topic: /bin/login Vulnerability
|
|
- -----------------------------------------------------------------------------
|
|
|
|
The CERT Coordination Center has learned of a vulnerability in
|
|
/bin/login. This vulnerability potentially affects all IBM AIX 3
|
|
systems and Linux systems. At this time, we believe that only
|
|
IBM AIX 3 and Linux systems are at risk.
|
|
|
|
Included with this advisory is an appendix that lists the vendors who have
|
|
responded to our inquiries, and the status of their investigation into this
|
|
vulnerability report. We will update this advisory as we receive additional
|
|
information.
|
|
|
|
- -----------------------------------------------------------------------------
|
|
|
|
I. Description of IBM AIX vulnerability
|
|
|
|
A vulnerability exists in /bin/login on all IBM AIX 3 systems.
|
|
|
|
II. Impact of IBM AIX vulnerability
|
|
|
|
Remote users can obtain unauthorized root access on the affected
|
|
hosts.
|
|
|
|
III. Solution for IBM AIX vulnerability
|
|
|
|
IBM is working on an official fix, which is still under
|
|
development. The reference number for this fix is APAR IX44254.
|
|
Until you obtain the official fix from IBM, we encourage you to
|
|
apply the workaround or install the emergency fix below.
|
|
|
|
A. Workaround
|
|
|
|
The recommended workaround is to disable the rlogin daemon:
|
|
|
|
1. As root, edit /etc/inetd.conf
|
|
Comment out the line 'login ... rlogin'
|
|
2. Run 'inetimp'
|
|
3. Run 'refresh -s inetd'
|
|
|
|
B. Emergency fix
|
|
|
|
The emergency fix for the different levels of AIX 3
|
|
affected by this vulnerability is available via anonymous
|
|
FTP from software.watson.ibm.com:/pub/rlogin/rlogin.tar.Z.
|
|
Installation instructions are included in the README file
|
|
(which is included in rlogin.tar.Z).
|
|
|
|
Checksum information for rlogin.tar.Z:
|
|
BSD: 25285 317
|
|
SystemV: 13021 633 rlogin.tar.Z
|
|
MD5: MD5 (rlogin.tar.Z) = 803ee38c2e3b8c8c575e2ff5e921034c
|
|
|
|
C. Official fix
|
|
|
|
The official fix for this problem can be ordered as
|
|
APAR IX44254.
|
|
|
|
To order an APAR from IBM in the U.S., call 1-800-237-5511
|
|
and ask IBM to ship it as soon as it is available.
|
|
According to IBM, this fix will be available in
|
|
approximately two weeks. APARs may be obtained outside the
|
|
U.S. by contacting your local IBM representative.
|
|
|
|
|
|
IV. Description of Linux vulnerability
|
|
|
|
A vulnerability exists in /bin/login for Linux systems.
|
|
|
|
V. Impact of Linux vulnerability
|
|
|
|
Any user, remote or local, can obtain unauthorized root access on
|
|
the affected hosts.
|
|
|
|
VI. Solution for Linux vulnerability
|
|
|
|
A set of tools has been released by Florian La Roche <flla@stud.uni-sb.de>
|
|
under the name "NetKit." It is available via the FTP sites listed below.
|
|
An excerpt from the README provides the following general information:
|
|
|
|
This directory contains a collection of net source programs for LINUX.
|
|
|
|
NetKit-A A is the first character in the alphabet -> basic things
|
|
contains a collection of LINUX-specific programs and
|
|
several small utility programs found somewhere in the
|
|
Internet or on News
|
|
(contains also net-032 from Alan Cox)
|
|
NetKit-B B like BSD, even if we only think about LINUX
|
|
contains source code derived from NetBSD
|
|
NetKit-M M like mail
|
|
contains context diffs and some source code to make a
|
|
good mail system
|
|
NetKit-N N like news
|
|
contains context diffs for a good News system
|
|
(news readers and also INN for your own newsfeed)
|
|
NetKit-X X like eXtra
|
|
will maybe be necessary, if NetKit-A grows too large
|
|
|
|
|
|
sunacm.swan.ac.uk:/pub/misc/Linux/Networking/PROGRAMS/Packages
|
|
------------------------------------------------------------------------
|
|
MD5 (NetKit-A-0.05.bin.tar.gz) = afe45e04f359b0ff99e66cc58b4e758c
|
|
MD5 (NetKit-A-0.05.tar.gz) = a17fae1b58e1cf8a79aef30296f65672
|
|
MD5 (NetKit-A-0.06.bin.tar.gz) = e0f813427341b070ab9f8374ad721134
|
|
MD5 (NetKit-A-0.06.tar.gz) = adb00607cb2887c44f5aa8981fb8120b
|
|
MD5 (NetKit-B-0.04.bin.tar.gz) = ffe7099a0271a85eb22c78f7c3373bc6
|
|
MD5 (NetKit-B-0.04.tar.gz) = 156be1d3571b1681485b47255f7e202c
|
|
MD5 (NetKit-B-0.05.bin.tar.gz) = 3b270017ce28328c5596291e6d2687f0
|
|
MD5 (NetKit-B-0.05.tar.gz) = ba2327f741a265edc252e86b442a0a0d
|
|
MD5 (NetKit-M-0.01.tar.gz) = 392cbe6454965ad0d9e12f98af4cdd4a
|
|
MD5 (NetKit-N-0.01.tar.gz) = 55957726205a52621a15938c3bea593b
|
|
|
|
sunsite.unc.edu:/pub/Linux/system/Network/sunacm
|
|
------------------------------------------------------------------------
|
|
MD5 (NetKit-A-0.05.bin.tar.gz) = afe45e04f359b0ff99e66cc58b4e758c
|
|
MD5 (NetKit-A-0.05.tar.gz) = a17fae1b58e1cf8a79aef30296f65672
|
|
MD5 (NetKit-A-0.06.bin.tar.gz) = e0f813427341b070ab9f8374ad721134
|
|
MD5 (NetKit-A-0.06.tar.gz) = adb00607cb2887c44f5aa8981fb8120b
|
|
MD5 (NetKit-B-0.04.bin.tar.gz) = ffe7099a0271a85eb22c78f7c3373bc6
|
|
MD5 (NetKit-B-0.04.tar.gz) = 156be1d3571b1681485b47255f7e202c
|
|
MD5 (NetKit-B-0.05.bin.tar.gz) = 3b270017ce28328c5596291e6d2687f0
|
|
MD5 (NetKit-B-0.05.tar.gz) = ba2327f741a265edc252e86b442a0a0d
|
|
MD5 (NetKit-M-0.01.tar.gz) = 392cbe6454965ad0d9e12f98af4cdd4a
|
|
MD5 (NetKit-N-0.01.tar.gz) = 55957726205a52621a15938c3bea593b
|
|
|
|
To address the local access problem, we encourage you to install
|
|
a version of /bin/login that does not allow the -f option in the
|
|
form "-f<user>", but only allows this option in the form
|
|
"-f <user>", as two arguments. At this time, we do not know
|
|
which versions of login.c are vulnerable.
|
|
|
|
|
|
.............................................................................
|
|
|
|
Appendix
|
|
|
|
We have received feedback from the following, who indicated that their
|
|
products are not vulnerable:
|
|
|
|
Amdahl
|
|
Apple
|
|
BSD
|
|
BSDI
|
|
FreeBSD
|
|
Harris
|
|
HP
|
|
Linux
|
|
Motorola
|
|
NeXT
|
|
Pyramid
|
|
SCO
|
|
Sequent
|
|
SGI
|
|
Solbourne
|
|
Sony
|
|
Sun
|
|
|
|
|
|
CERT has received feedback from the following vendors, who have made
|
|
patches available to address the /bin/login vulnerability. Please
|
|
note that vendors sometimes update patch files. If you find that the
|
|
checksum is different, please contact the vendor.
|
|
|
|
|
|
IBM - Please see Sec. III, "Solution for IBM AIX vulnerability" for details.
|
|
Briefly--
|
|
Official patch: APAR IX44254.
|
|
Emergency fix: Available via anonymous FTP from:
|
|
software.watson.ibm.com:/pub/rlogin
|
|
|
|
This directory contains the latest available emergency
|
|
fix for APAR IX44254. As updates become available,
|
|
any new versions will be placed in this directory with
|
|
the name rlogin<#>.tar.Z with <#> being incremented
|
|
for each update. See the README.FIRST file in that
|
|
directory for details.
|
|
|
|
LINUX: - Please see Sec. VI, "Solution for Linux vulnerability" for details.
|
|
Briefly--
|
|
"Netkit" is available from
|
|
sunacm.swan.ac.uk:/pub/misc/Linux/Networking/PROGRAMS/Packages
|
|
sunsite.unc.edu:/pub/Linux/system/Network/sunacm
|
|
|
|
|
|
- ---------------------------------------------------------------------------
|
|
The CERT Coordination Center wishes to thank Axel Clauberg of
|
|
University of Cologne for reporting the IBM AIX problem, and
|
|
IBM for their assistance in responding to this problem.
|
|
- ---------------------------------------------------------------------------
|
|
|
|
If you believe that your system has been compromised, contact the CERT
|
|
Coordination Center or your representative in Forum of Incident
|
|
Response and Security Teams (FIRST).
|
|
|
|
If you wish to send sensitive incident or vulnerability information to
|
|
CERT via electronic mail, CERT strongly advises that the e-mail be
|
|
encrypted. CERT can support a shared DES key, PGP (public key
|
|
available via anonymous FTP on info.cert.org), or PEM (contact CERT
|
|
for details).
|
|
|
|
Internet E-mail: cert@cert.org
|
|
Telephone: 412-268-7090 (24-hour hotline)
|
|
CERT personnel answer 8:30 a.m.-5:00 p.m. EST(GMT-5)/EDT(GMT-4),
|
|
and are on call for emergencies during other hours.
|
|
|
|
CERT Coordination Center
|
|
Software Engineering Institute
|
|
Carnegie Mellon University
|
|
Pittsburgh, PA 15213-3890
|
|
USA
|
|
|
|
Past advisories, information about FIRST representatives, and other
|
|
information related to computer security are available for anonymous FTP from
|
|
info.cert.org.
|
|
|
|
Copyright 1994, 1995, 1996 Carnegie Mellon University
|
|
This material may be reproduced and distributed without permission provided
|
|
it is used for noncommercial purposes and the copyright statement is
|
|
included.
|
|
|
|
CERT is a service mark of Carnegie Mellon University.
|
|
|
|
===========================================================================
|
|
UPDATES
|
|
|
|
We are aware that there have been several /bin/login wrapper
|
|
programs posted as proposed workarounds for this vulnerability. None
|
|
of the wrappers that CERT has reviewed have fully addressed all
|
|
aspects of this vulnerability. CERT will not undertake any further
|
|
review of such wrappers. Instead, we encourage sites to apply the
|
|
appropriate workaround or patches available, as described in
|
|
CA-94:09.bin.login.vulnerability.
|
|
|
|
Frequently Asked Question about this CERT advisory:
|
|
|
|
Question: Why is rshd not mentioned in this advisory?
|
|
Answer: From the man page for RSH(1C):
|
|
|
|
rsh hostname [ -l username ] [ -n ] [ command ]
|
|
|
|
rsh connects to the specified hostname and
|
|
executes the specified command.
|
|
If you omit [ command ], instead of executing a
|
|
single command, rsh logs you in on the remote host
|
|
using rlogin(1C).
|
|
|
|
rsh hostname [ -l username ] [ -n ]
|
|
|
|
Exploitation of the vulnerability via rsh requires the
|
|
use of rlogind, which then invokes /bin/login.
|
|
Exploitation of this vulnerability by this method is
|
|
addressed by this advisory.
|
|
|
|
CERT/CC are not aware of any exploitation method for this
|
|
vulnerability via the following usage:
|
|
|
|
rsh hostname [ -l username ] [ -n ] command
|
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
Revision history
|
|
|
|
Aug. 30, 1996 Information previously in the README was inserted into the
|
|
advisory. The result is a major update to patch information in
|
|
Sections III and VI.
|
|
Mar. 29, 1996 Updates section - Removed duplicate information from the
|
|
"Frequently Asked Question" section
|
|
Feb. 02, 1995 Section III - Updated Linux patch information
|
|
May 27, 1994 Updates section - Included caveat concerning other /bin/login
|
|
wrapper programs and comments about rshd
|
|
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBMiSVVHVP+x0t4w7BAQGBoQP9HUKDQbIdJrTomHR2mUZNoI/3sUefSb49
|
|
MbuIER9uJf5MiZooN0m1sPfl5o8dMpKA0vt8HdUf3xJviqj3J4+iT2aDt4xiYLL3
|
|
qg6uY7p9aRMRBDUyAj2ePku0WPk35Qqo3qZOQAJfAnX4lfKd5DnNuPerMq3ezBzc
|
|
56DZyZA2k60=
|
|
=fawd
|
|
-----END PGP SIGNATURE-----
|
|
|