## Walld Vulnerability

### Risk Factor: 10

### Machines Affected:

Most UNIXes

### Description:

rwall reads a message from standard input, and then sends this message to all users logged into the specified host machines. With the -n option rwall sends the message to the specified network groups as defined in /etc/netgroup. Machines can only recieve such messages if they are running walld (check your inetd.conf file). If you are running walld then the wall command can write to any file in a world or group writeable /etc/utmp directory. The /etc/utemp directory contains a listing of all currently logged in users. In many cases all users must be given write permissions to /etc/utemp. An intruder can then edit this file to contain the entry

    .ce 1 \&../etc/passwd .br

and then creates a password file that will replace the current one so as to give administrator access >

### Transfer interrupted!