OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Sep) 1994: Re: Security Info (root broken)

Re: Security Info (root broken)

Pug (pugarlut.utexas.edu)
Thu, 29 Sep 1994 07:41:03 -0600 (CDT) 

> >>>>> On Thu, 29 Sep 1994 07:04:44 -0600 (CDT), Pug <pugarlut.utexas.edu> said:
>     >> This was a new
>     >> install, and it lasted about 4 days.   One person heard thru the cracker
>     >> grapvine that root was broken thru /bin/mail.
>     P> Did you happen to install the following, in particular 101436-02?
>     P> Solaris 1.1.1 Patches Containing Security Fixes:
>     P> ------------------------------------------------
>     P> 101436-02   SunOS 4.1.3_U1: bin/mail jumbo patch
> This is the patch which made the race condition *easier* to exploit
> than it was in the unpatched version.

As I remember the race condition, you don't have a problem if you don't
allow the 'r' commands into your system. The race condition created a
.rhosts file for accounts that had UID 0, but no existing .rhosts file.
I can't find my copy of the exploit anymore to be certain. As well, you
had to start on the system, so it wasn't that much of an external job
anyway.

I see allowing 'r' commands into your installation as a Bad Thing anyway.

Ciao,

-- 
Richard Bainter          Mundanely     |    System Analyst        - OMG/CSD
Pug                      Generally     |    Applied Research Labs - U.Texas
          pugarlut.utexas.edu         |    pugbga.com
Note: The views may not reflect my employers, or even my own for that matter.