Subject: Bug#3977: [linux-security] LSF Update#11: Vulnerability of rlogin (fwd)

From: Marek Michalkiewicz <[email-masked]>
Date: Wed, 31 Jul 1996 12:21:46 +0200 (MET DST)

Package: netstd
Version: 2.05-1

If that's the TERM buffer overrun - we are vulnerable :(.

Since we have many other fixes which are not yet in NetKit-B-0.07
(I'll be sending patches for NetKit soon), it might be a good idea
to just fix rlogin for now, and start moving to NetKit later.

diff -urN rlogin.orig/rlogin.c rlogin/rlogin.c
--- rlogin.orig/rlogin.c	Sat Apr 16 22:43:23 1994
+++ rlogin/rlogin.c	Wed Jul 31 12:12:36 1996
@@ -273,10 +273,14 @@
 		exit(1);
 	}
 
-	(void)strcpy(term, (p = getenv("TERM")) ? p : "network");
+	p = getenv("TERM");
+	if (!p)
+		p = "network";
 	if (ioctl(0, TIOCGETP, &ttyb) == 0) {
-		(void)strcat(term, "/");
-		(void)strcat(term, speeds[ttyb.sg_ospeed]);
+		snprintf(term, sizeof(term),
+			"%.256s/%s", p, speeds[ttyb.sg_ospeed]);
+	} else {
+		snprintf(term, sizeof(term), "%.256s", p);
 	}
 
 	(void)get_window_size(0, &winsize);

> From [email-masked]  Wed Jul 31 10:49:02 1996
> Message-Id: <[email-masked]>
> To: [email-masked]
> Cc: [email-masked]
> Subject: [linux-security] LSF Update#11: Vulnerability of rlogin
> Date: 	Tue, 30 Jul 1996 18:11:00 -0400
> From: "Alexander O. Yuriev" <[email-masked]>
> Sender: [email-masked]
> Precedence: list
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
>                           Linux Security FAQ Update
>                             rlogin Vulnerability
>                         Tue Jul 30 17:51:57 EDT 1996
>       Copyright (C) 1995 Alexander O. Yuriev ([email-masked])
>                               CIS Laboratories
>                              TEMPLE  UNIVERSITY
>                                    U.S.A.
> 
>  =============================================================================
>  This is an official update of the Linux security FAQ, and it is supposed to
>                 be signed by one of the following PGP keys:
> 
>         
>      pub  1024/9ED505C5 1995/12/06 Jeffrey A. Uphoff <[email-masked]>
>                   Jeffrey A. Uphoff <[email-masked]>      
>            1024/EFE347AD 1995/02/17 Olaf Kirch <[email-masked]>
>  1024/ADF3EE95 1995/06/08 Linux Security FAQ Primary Key <Alexander O. Yuriev>
> 
>     Unless you are able to verify at least one of signatures, please be very
>                     careful when following instructions.
> 
>    Linux Security WWW: http://bach.cis.temple.edu/linux/linux-security
> 
>              linux-security & linux-alert mailing list archives:
> 	
>             ftp://linux.nrao.edu/pub/linux/security/list-archive
> 
>  =============================================================================
> 
>    ABSTRACT
> 
>    		A vulnerability exists in the rlogin program of NetKitB-0.6
> 		This vulnerability affects several widely used Linux
> 		distributions, including RedHat Linux 2.0, 2.1 and derived
> 		systems including Caldera Network Desktop, Slackware 3.0 and
> 		others. This vulnerability is not limited to Linux or any
> 		other free UNIX systems. Both the information about this
> 		vulnerability and methods of its expolit were made available
> 		on the Internet.
> 
>    RISK ASSESMENT
> 
> 		Local and remote users could gain super-user priviledges
> 
>    DISTRIBUTION FIXES
> 
> 
>    		Red Hat Commercial Linux
> 
> 			Red Hat Linux version 2.0 and 2.1 contains
> 			vulnerable program unless NetKit-B-0.06-7.i386.rpm
> 			was installed.
> 
> 			In order to fix the vulnerability install
> 			NetKit-B-0.06-7 rpm available from
> 
> ftp://ftp.redhat.com/pub/redhat/old-releases/redhat-2.1/i386/updates/RPMS/NetKit-B-0.06-7.i386.rpm
> ftp://bach.cis.temple.edu/pub/Linux/security/DISTRIBUTION-FIXES/RedHat-2.1/NetKit-B-0.06-7.i386.rpm
> ftp://tarsier.cv.nrao.edu/pub/linux/security/DISTRIBUTION-FIXES/RedHat-2.1/NetKit-B-0.06-7.i386.rpm
> 
> 			Please verify the MD5 signature of the RPM prior to
> 			installing it.
> 
>          601c3f6137a6fb15ae61a6b817395040  NetKit-B-0.06-7.i386.rpm
> 
> 			Red Hat Linux version 3.0.3 (Picasso) does not
> 			contain vulnerable rlogin program.
> 
> 		Caldera Network Desktop 
> 
> 			Version 1 of CND contains the vulnerable program
> 			unless NetKit-B-0.06-4c1.i386.rpm was installed. 
> 			This RPM is available from
> 
> ftp://ftp.caldera.com/pub/cnd-1.0/updates/NetKit-B-0.06-4c1.i386.rpm
> ftp://bach.cis.temple.edu/pub/Linux/Security/DISTRIBUTION-FIXES/CND/NetKit-B-0.06-4c1.i386.rpm
> ftp://tarsier.cv.nrao.edu/pub/linux/security/DISTRIBUTION-FIXES/CND/NetKit-B-0.06-4c1.i386.rpm
> 
> 			Please verify the MD5 signature of RPM prior to
> 			installing it.
> 
>         aeb2da201477cd3280fdc09836395c35  NetKit-B-0.06-4c1.i386.rpm
> 
> 			Version 1 of CND upgraded to RedHat Linux 3.0.3
> 			(Picasso) does not contain a vulnerable program.
>  
> 		Debian
> 
> 			Debian Project did not either confirm or deny the
> 			vulnerability of Debian/GNU Linux 1.1.
> 
> 			Debian/GNU Linux systems may be vulnerable if
> 			NetKit-B-0.6 is installed. Until the official
> 			fix-kit is available for Debian/GNU Linux, system
> 			administrators of Debian systems are advised to
> 			follow guidelines under Other Linux Distributions
> 			section.
> 
> 		Slackware
> 
> 			The Slackware Linux distribution Version 3.0 is
> 			confirmed to be vulnerable unless a NetKit newer
> 			than NetKit-B-0.6 is installed.
> 
> 			Until the official fix-kit is available for
> 			Slackware 3.0, the system administrators are advised
> 			to follow the guidelines under Other Linux
> 			Distributions section.
> 
> 		Yggdrasil
> 
> 			Yggdrasil Computing's Plug & Play Linux Fall'95
> 			contains vulnerable rlogin program.
> 
> 			Adam J. Richter from Yggdrasil Computing made an
> 			unofficial fix-kit available at
> 			ftp.yggdrasil.com/pub/support/fall95/rlogin_fix/
> 
> 			We are unable to provide MD5 signature for the fix
> 			kit as we are unable to verify the integrity of the
> 			message.
> 
> 		Other Linux Distributions
> 
> 			System administrators of systems based on other
> 			Linux distributions or distributions that do not
> 			have official patch-kits available are advised to
> 			install newly released NetKit-B-0.7 available from
> 			ftp://ftp.uk.linux.org/pub/linux/Networking/base
> 			and ftp://sunsite.unc.edu/pub/Linux/Incoming
> 
> 	CREDITS
> 
> 		This LSF Update is based on the information provided by Alan
> 		Cox. The first patch for rlogin program was provided by Marc
> 		Ewing of Red Hat Software. Ron Holt of Caldera Inc provided
> 		fixed RPM for Caldera Network Desktop within 3 hours after
> 		the initial contact. Adam J. Richter provided unofficial
> 		information about the unofficial fix-kit for Yggdrasil Plug
> 		and Play Linux Fall'95.
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
> 
> iQCVAwUBMf6EsYxFUz2t8+6VAQFDVAQAloKbM00wdzNCwcyo9Wz8wJo54a+TwYN6
> Xua/PFBnhunCpJy/T0BOO/Dh1IBE/mCu2FSNMK/bkRXel6Om9lEzjDHlyeUizeBI
> enIAOWQvNBf0e+/lHJXXtCSIWNeSfSysCaP98Y7F6bouZc14l1d/PJg7eSmWikFG
> HhgcRl6ZyHM=
> =hG1l
> -----END PGP SIGNATURE-----
>

---

From: [email-masked] (J.H.M.Dassen)
Date: Wed, 31 Jul 1996 13:57:54 +0200 (MDT)

> diff -urN rlogin.orig/rlogin.c rlogin/rlogin.c

Great.

> > 			vulnerability of Debian/GNU Linux 1.1.

Does anyone know who has been contacted? If the quote above is indeed
a polite way of saying "we got no reply" or "we didn't know whom to mail",
we have a communications problem that should be addressed.

Ray
-- 
POPULATION EXPLOSION  Unique in human experience, an event which happened 
yesterday but which everyone swears won't happen until tomorrow.  
- The Hipcrime Vocab by Chad C. Mulligan

---

From: "Alexander O. Yuriev" <[email-masked]>
Date: Wed, 31 Jul 1996 12:16:01 -0400

Your message dated: Wed, 31 Jul 1996 13:57:54 +0200
> we have a communications problem that should be addressed.

That is a polite way of saying that I did not receive any reply in more than
a week to mail sent to [email-masked] which became my contact after Ian
left position of the project coordinator. We had great communications with
Debian prior to that so I though that someone just did not want to make any
kind of confirmation. I'd appreciate if someone could name an additional
contact.

Best wishes,
Alex

---

From: "Peter Tobias" <[email-masked]>
Date: Wed, 31 Jul 1996 23:48:40 +0200 (MET DST)

> kind of confirmation. I'd appreciate if someone could name an additional

We should probably have a "[email-masked]" email address. The mail
could be forwarded directly to debian-private or to the maintainer of
the package.

Anyway, the Debian netstd package is affected as well. A new netstd
package (v2.06) will be available within a few hours from ftp.debian.org
(/debian/buzz-updates/binary-i386/netstd_2.06-1.i386.deb).

Thanks,

Peter

-- 
 Peter Tobias                                EMail:
 Fachhochschule Ostfriesland                 [email-masked]
 Fachbereich Elektrotechnik und Informatik   [email-masked]
 Constantiaplatz 4, 26723 Emden, Germany     [email-masked]