Rwho daemon overflow
| rwhod-vuln (118) |  High Risk |
Description:
The rwhod daemon is vulnerable to a denial of service attack caused by a buffer overflow. Rwhod fails to do bounds checking on data it receives from a UDP packet before copying it into a buffer. By sending a specially formatted UDP packet, a remote attacker can overflow the buffer to crash rwhod, execute code as root, or cause a change in process status information for rwhod. The status of most Unix systems can be checked by executing ps -a.
Without the rwho daemon, administrators may be unable to determine who is currently logged into the target server.
Platforms Affected:
- Compaq, Tru64
- Data General, DG/UX
- FreeBSD, FreeBSD
- HP, HP-UX
- IBM, AIX 4.2
- IBM, AIX
- Linux, Kernel
- NetBSD, NetBSD
- SCO, SCO Unix
- SGI, IRIX
- Sun, Solaris
- WindRiver, BSDOS
Remedy:
Most modern distributions of the affected systems include whod daemons that fix this buffer overflow. Sites that do not use the rwho services should disable this service by commenting it out of the inetd.conf file or appropriate RC scripts. AIX users should obtain and install the following patch: AIX 4.2: IX61127
Consequences:
Denial of Service
References:
- BugTraq Mailing List, Wed, 21 Aug 1996 16:38:57 -0400, rwhod buffer overflow at http://archives.neohapsis.com/archives/bugtraq/1996_3/0376.html.
- CVE-1999-0085: Buffer overflow in rwhod on AIX and other operating systems allows remote attackers to execute arbitrary code via a UDP packet with a long hostname.
- CVE-1999-0628: The rwho/rwhod service is running, which exposes machine status and user information.
Reported:
Aug 21, 1996
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net