## Login Vulnerability

### Risk Factor: 10

### Machines Affected:

Linux, AIX 3

### Description:

With some of the newer versions of rlogind it does not call login via login -r (IOW, with a command line), rather it calls login via rlogind. When it does call login via rlogind it does so in the following manner;

     When authenticated - login -p -h  -f lusername
     When not authenticated - login -p -h  lusername

The problem is that login does not know how parse the command lines correctly. IOW, to login, -f lusername looks the same as -flusername. Now, normally if we tried to pass -f lusername to login it would not work because login would recognize the space between the "-f" and the "lusername," and see that -f is a flag that is not allowed to be passed by the intruder. However, in this case login does not see the difference between -f lusername and -flusername except that since there is no space it does not parse the command correctly. Where you can not pass "-f lusername" you can pass "-flusername" and this will cause login to think that the username is authenticated. "-froot" gives you root access in many cases. EX.

    rlogin victim.com -l -froot

would give you root acces on victim.com if they are vulnerable.

### Consequences:

With AIX remote users can become root.
With Linux any user - local or remote, can become root.

### Fix:

### On AIX

- Disable rlogind in /etc/inetd.conf
OR
Get a patch for rlogin from software.watson.ibm.com:/pub/rlogin/rlogin.tar.Z
OR
You can order the patch from IBM The official fix for this problem can be ordered as APAR IX44254. To order an APAR from IBM in the U.S., call 1-800-237-5511 and ask IBM to ship it as soon as possible.

### On linux

Upgrade to latest version of Linux

Links for advisories/more info Cert CA-94:09