## Admind Vulnerability

### Risk Factor: 10

### Machines Affected:

Most UNIXes running admind.

### Description:

Admind is the daemon used by system administration tools to perform distributed system administration operations. The admind daemon is started automatically by the inetd daemon whenever a request is received. It can also be configured for logging, and certain command line options can be set, like -s which is the security level. There are 3 levels of security associated with the -s option:

- 0 - Set authentication to none. All UIDs and GIDs are set to nobody by admind.
- 1 - Set authentication to weak. GIDs and UIDs are set by admind according to their "authentication credentials" set by auth_sys. If an operation calls for a stronger security level, admind demotes the user identity to nobody, and then checks whether nobody is authorized to execute the operation. AUTH_SYS client credentials are easily forged. No check is done that the user ID of the client represents the same user on the server system as on the client system. It is assumed that user and group identities are set up consistently on the network. This security level is the default.
- 2 - Set authentication to strong. Clients' user and group identities are set by admind from user and group IDs from netid.byname for NIS, or cred table for NIS+. Client identities are accepted by admind only when they have satisfied the AUTH_DES authentication mechanism. The admind daemon checks whether the client identity is authorized to execute the operation.

Admind runs insecure by default. Any user can run it and change the password file

### Consequences:

Any user can run it and change the password file, giving them administrator access (root).

### Fix:

Disable admind in inetd.conf or run it more securely by adding the -s 2 flag in the inetd.conf file like so:

    100087/10          tli       rpc/udp       wait    root
    /usr/sbin/admind admind -S 2

Links for advisories/more info Patches available at;
Solaris Patch ID: 101384-XX at Sun Patches