Rsh NULL login could grant unauthorized access
| rsh-null (112) |  High Risk |
Description:
Older versions of the in.rshd daemon allow users to log in as the NULL user that, because of a vulnerability in the rusersok function call, would grant access without proper authorization.
Platforms Affected:
- Compaq, Tru64
- Data General, DG/UX
- HP, HP-UX
- IBM, AIX
- Linux, Kernel
- SCO, SCO Unix
- SGI, IRIX
- Sun, Solaris
- WindRiver, BSDOS
Remedy:
Disable the RSH service by commenting it out of the inetd.conf file and restarting the inetd process. If your configuration requires the use of RSH facilities, you should contact your vendor for patch information or install a RSH from a third party package.
Consequences:
Gain Access
References:
- CVE-1999-0180: in.rshd allows users to login with a NULL username and execute commands.
Reported:
Not available
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net