rexd Vuln

## REXD Vulnerability

### Risk Factor: 9

### Machines Affected:

Most UNIXes, NeXT Step (by default, rexd(8C) is enabled in NeXTstep versions 2.0 and 2.1. Note that no NeXT software uses rexd), versions 3.1 and 3.2 of AIX

### Description:

Rexd is the UNIX rpc (remote procedure call) based execution server. On is rexd's complimentary client program. Rexd recieves from the client the command to be executed, along with a user and group ID. Rexd does not require that the client use a priveledged port, and it believes everything that the client tells it by default (except that you are root).

### Consequences:

Anyone on the network (or the Internet) can execute commands as any user except root.

### Fix:

1) Comment out the rexd line in /etc/inetd.conf and send a HUP signal to inetd or a

    refresh -s inetd

2) Run rexd (if you must) in a more secure manner (with the DES authentication option. Check your man pages to see if it is available to you).

### Additional considerations:

Installing NFS with "mknfs" may re-enable rexd even if it was previously disabled.

Links for advisories/more info

CERT: CA-91:06.NeXTstep.vulnerability
CA-92:05.AIX.REXD.Daemon.vulnerability

Sun OS Patch ID: 100421-XX at Sun Patches