Rwho daemon overflow
| rwhod-vuln (118) |  High Risk |
Description:
The rwhod daemon is vulnerable to a denial of service attack caused by a buffer overflow. Rwhod fails to do bounds checking on data it receives from a UDP packet before copying it into a buffer. By sending a specially formatted UDP packet, a remote attacker can overflow the buffer to crash rwhod, execute code as root, or cause a change in process status information for rwhod. The status of most Unix systems can be checked by executing ps -a.
Without the rwho daemon, administrators may be unable to determine who is currently logged into the target server.
Consequences:
Denial of Service
Remedy:
Most modern distributions of the affected systems include whod daemons that fix this buffer overflow. Sites that do not use the rwho services should disable this service by commenting it out of the inetd.conf file or appropriate RC scripts. AIX users should obtain and install the following patch: AIX 4.2: IX61127
References:
- BugTraq Mailing List, Wed, 21 Aug 1996 16:38:57 -0400: rwhod buffer overflow.
- CVE-1999-0085: Buffer overflow in rwhod on AIX and other operating systems allows remote attackers to execute arbitrary code via a UDP packet with a long hostname.
- CVE-1999-0628: The rwho/rwhod service is running, which exposes machine status and user information.
Platforms Affected:
- Compaq Tru64
- Data General DG/UX
- FreeBSD FreeBSD
- IBM AIX 4.2
- IBM AIX
- Linux Kernel
- NetBSD NetBSD
- SCO SCO Unix
- SGI IRIX
- Sun Solaris
- WindRiver BSDOS
- HP-UX
Reported:
Aug 21, 1996
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net