## NIS Vulnerability

### Risk Factor: 7

### Machines Affected:

SunOS 3.x, 4.x, and most other NIS implementations

### Description:

NIS shares databases (called NIS Maps) for administrative information. Some of these are:

- Password files
- Lists (tables) of hostnames and addresses on the network
- Mail aliases

These can be gotten by anybody who can supply the following information to the server:

- NIS domain name
- Map name (ex. passwd)

An intruder can use an rpc command to tell if your machine is an NIS server.

Ex.

    %~home> rpcinfo -p yourmachine.com
         program vers proto   port
         100004    2   tcp    673  ypserv
         100005    1   udp    721  mountd
         100003    2   udp   2049  nfs

Now that the intruder knows that this is a server (notice the ypserv entry), it can obtain the NIS domain names of the clients in any of a number of ways:

    %~home> showmount -e yourmachine.com
     export list for victim.com:
     /export
     /var
     /usr

We see that the /var directory is mountable. When we mount this we get:

    home # mount yourmachine.com:/var /foo
    home # cd /foo
    home # /bin/ls -alg /foo/yp
     total 17
        1 drwxr-sr-x  4 root     staff         512 Jul 12 14:22 .
        1 drwxr-sr-x 11 root     staff         512 Jun 29 10:54 ..
       11 -rwxr-xr-x  1 root     staff       10993 Apr 22 11:56 Makefile
        1 drwxr-sr-x  2 root     staff         512 Apr 22 11:20 binding
        2 drwxr-sr-x  2 root     staff        1536 Jul 12 14:22 foo_bar

foo_bar is the NIS domain name.

The other methods involve guessing the possible NIS domain names (using ypwhich), and using the bootparam bug described elsewhere in this database.

You can now ask the NIS server for the passwd file.

### Consequences:

A password file can be obtained and cracked, giving the intruder complete access to any whose password has been cracked.

### Fix:

- Run crack yourself, and make sure that the passwords can not be cracked
- Run a secure implementation of RPC
- Make your ypdomain name long (max. 64 bytes), and completely unrelated to your site (IOW, not easily guessable)
- Switch off access to port 111 (portmapper) so that at least a little more effort is required to find the ypserv service. At least this way the probes would be noticed by an alert system administrator.
- From Sun:
  - Do not run ypserv on your Internet gateway
  - Do not do IP routing from your Internet gateway to the rest of your machines
- Several vendors have added access control to their ypserv implementation. Check your system documentation or vendor patch list. The control file is sometimes called securenets.
- Run a portmapper with access control.

  Links for advisories/more info
  CERT 92:13 - SunOS NIS Vulnerability
  A more secure portmapper
  Admin guide to Cracking - 101