Subject: Sicherheitsluecke bei rlogin auf Linux [LSF Update#11: Vulnerability of rlogin] (fwd)

From: Steffen Mueller <[email-masked]>
Date: Thu, 1 Aug 1996 08:58:08 +0200 (MET DST)

FYI :

Here's what we got from CERT a few minutes ago.

- -----BEGIN PGP SIGNED MESSAGE-----

                          Linux Security FAQ Update
                            rlogin Vulnerability
                        Tue Jul 30 17:51:57 EDT 1996
      Copyright (C) 1995 Alexander O. Yuriev ([email-masked])
                              CIS Laboratories
                             TEMPLE  UNIVERSITY
                                   U.S.A.

 =============================================================================
 This is an official update of the Linux security FAQ, and it is supposed to
                be signed by one of the following PGP keys:

     pub  1024/9ED505C5 1995/12/06 Jeffrey A. Uphoff <[email-masked]>
                  Jeffrey A. Uphoff <[email-masked]>      
           1024/EFE347AD 1995/02/17 Olaf Kirch <[email-masked]>
 1024/ADF3EE95 1995/06/08 Linux Security FAQ Primary Key <Alexander O. Yuriev>

    Unless you are able to verify at least one of signatures, please be very
                    careful when following instructions.

   Linux Security WWW: http://bach.cis.temple.edu/linux/linux-security

             linux-security & linux-alert mailing list archives:
	
            ftp://linux.nrao.edu/pub/linux/security/list-archive

 =============================================================================

   ABSTRACT

   		A vulnerability exists in the rlogin program of NetKitB-0.6
		This vulnerability affects several widely used Linux
		distributions, including RedHat Linux 2.0, 2.1 and derived
		systems including Caldera Network Desktop, Slackware 3.0 and
		others. This vulnerability is not limited to Linux or any
		other free UNIX systems. Both the information about this
		vulnerability and methods of its expolit were made available
		on the Internet.

   RISK ASSESMENT

		Local and remote users could gain super-user priviledges

   DISTRIBUTION FIXES

   		Red Hat Commercial Linux

			Red Hat Linux version 2.0 and 2.1 contains
			vulnerable program unless NetKit-B-0.06-7.i386.rpm
			was installed.

			In order to fix the vulnerability install
			NetKit-B-0.06-7 rpm available from

ftp://ftp.redhat.com/pub/redhat/old-releases/redhat-2.1/i386/updates/RPMS/NetKit-B-0.06-7.i386.rpm
ftp://bach.cis.temple.edu/pub/Linux/security/DISTRIBUTION-FIXES/RedHat-2.1/NetKit-B-0.06-7.i386.rpm
ftp://tarsier.cv.nrao.edu/pub/linux/security/DISTRIBUTION-FIXES/RedHat-2.1/NetKit-B-0.06-7.i386.rpm

			Please verify the MD5 signature of the RPM prior to
			installing it.

         601c3f6137a6fb15ae61a6b817395040  NetKit-B-0.06-7.i386.rpm

			Red Hat Linux version 3.0.3 (Picasso) does not
			contain vulnerable rlogin program.

		Caldera Network Desktop 

			Version 1 of CND contains the vulnerable program
			unless NetKit-B-0.06-4c1.i386.rpm was installed. 
			This RPM is available from

ftp://ftp.caldera.com/pub/cnd-1.0/updates/NetKit-B-0.06-4c1.i386.rpm
ftp://bach.cis.temple.edu/pub/Linux/Security/DISTRIBUTION-FIXES/CND/NetKit-B-0.06-4c1.i386.rpm
ftp://tarsier.cv.nrao.edu/pub/linux/security/DISTRIBUTION-FIXES/CND/NetKit-B-0.06-4c1.i386.rpm

			Please verify the MD5 signature of RPM prior to
			installing it.

        aeb2da201477cd3280fdc09836395c35  NetKit-B-0.06-4c1.i386.rpm

			Version 1 of CND upgraded to RedHat Linux 3.0.3
			(Picasso) does not contain a vulnerable program.
 
		Debian

			Debian Project did not either confirm or deny the
			vulnerability of Debian/GNU Linux 1.1.

			Debian/GNU Linux systems may be vulnerable if
			NetKit-B-0.6 is installed. Until the official
			fix-kit is available for Debian/GNU Linux, system
			administrators of Debian systems are advised to
			follow guidelines under Other Linux Distributions
			section.

		Slackware

			The Slackware Linux distribution Version 3.0 is
			confirmed to be vulnerable unless a NetKit newer
			than NetKit-B-0.6 is installed.

			Until the official fix-kit is available for
			Slackware 3.0, the system administrators are advised
			to follow the guidelines under Other Linux
			Distributions section.

		Yggdrasil

			Yggdrasil Computing's Plug & Play Linux Fall'95
			contains vulnerable rlogin program.

			Adam J. Richter from Yggdrasil Computing made an
			unofficial fix-kit available at
			ftp.yggdrasil.com/pub/support/fall95/rlogin_fix/

			We are unable to provide MD5 signature for the fix
			kit as we are unable to verify the integrity of the
			message.

		Other Linux Distributions

			System administrators of systems based on other
			Linux distributions or distributions that do not
			have official patch-kits available are advised to
			install newly released NetKit-B-0.7 available from
			ftp://ftp.uk.linux.org/pub/linux/Networking/base
			and ftp://sunsite.unc.edu/pub/Linux/Incoming

	CREDITS

		This LSF Update is based on the information provided by Alan
		Cox. The first patch for rlogin program was provided by Marc
		Ewing of Red Hat Software. Ron Holt of Caldera Inc provided
		fixed RPM for Caldera Network Desktop within 3 hours after
		the initial contact. Adam J. Richter provided unofficial
		information about the unofficial fix-kit for Yggdrasil Plug
		and Play Linux Fall'95.

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMf6EsYxFUz2t8+6VAQFDVAQAloKbM00wdzNCwcyo9Wz8wJo54a+TwYN6
Xua/PFBnhunCpJy/T0BOO/Dh1IBE/mCu2FSNMK/bkRXel6Om9lEzjDHlyeUizeBI
enIAOWQvNBf0e+/lHJXXtCSIWNeSfSysCaP98Y7F6bouZc14l1d/PJg7eSmWikFG
HhgcRl6ZyHM=
=hG1l
- -----END PGP SIGNATURE-----

- ----- End Included Message -----

---

From: Stephen Masterman <[email-masked]>
Date: Thu, 1 Aug 96 23:28 EDT

...
>		others. 
...
>		Local and remote users could gain super-user priviledges
...
>			follow guidelines under Other Linux Distributions

Anyone have any more comments about this? There is no package called NetKit
that I know of, I'm just curious if the developers have anything to say?

Thanks,
Steve
---
Disgusted by politicians and their government? Check out:
http://www.HarryBrowne96.org/

---

From: [email-masked] (Alan Cox)
Date: 3 Aug 1996 21:41:55 +0100

In article <[email-masked]>,
>that I know of, I'm just curious if the developers have anything to say?

The debian box I checked had all the netkit bugs in it, every last little
one except for one - the telnetd environment bug.

I've no idea what Debian has chosen to rename netkit as in its internal
packaging system, but at minimum you want to replace

o	rlogin		(TERM bug - present in all commercial systems I've
			 tried so ask vendors for a fix too)
o	talkd		(DNS spoofing flash bug, also spoof scribble)

Note: the rlogin bug requires an account to exploit

o	rdist		IF you are running it setuid (buffer overrun as
			seems traditional in older 4.x BSD derived code)

Alan
-- 
--------------------------------.----------------------------------------------
UKUU free UUCP Project Swansea  |   Alan Cox, <[email-masked]>
+44 1792 422028 (Cabletel)  	|   Custom Linux Software Projects.
Sonix 33.6K  24x7	 	|   Linux Consultancy. Linux Networking.