[681] in linux-security and linux-alert archive
[linux-security] Re: WARNING: libc/ruserok security hole
daemon@ATHENA.MIT.EDU (owner-linux-security@tarsier.cv.nr)
Mon Apr 22 04:39:30 1996
From: owner-linux-security@tarsier.cv.nrao.edu
Date: Sun, 21 Apr 1996 19:14:09 -0700 (MST)
To: Joel Maslak <j@pobox.com>
cc: linux-security@tarsier.cv.nrao.edu, best-of-security@suburbia.net,
linux-gcc@vger.rutgers.edu, nclug@vis.colostate.edu
In-Reply-To: <Pine.LNX.3.93.960421150624.16639A-100000@blackhole.blackfire.com>
On Sun, 21 Apr 1996, Joel Maslak wrote:
>
> libc 5.3.9 has a major security bug in it. It affects rlogin/rsh.
>
> Scope: If your system uses rlogin/rsh, local and remote users may
> rsh/rlogin to an arbitrary account on your system.
>
> Fix:
> Method (1): downgrade libc. I know 5.0.9 is secure.
> Method (2): add user name specifications to all .rhosts files.
>
> I.E.: .rhosts:
> plains.uwyo.edu jmaslak
>
> NOT:
> plains.uwyo.edu
>
um... this might not be enough. i was able to rlogin to every other
account on my machine (except root) with:
rlogin localhost -l <username>
even when i put in the user name specification. it didn't matter if
there was a .rhosts file there or not. taking "localhost" out of
/etc/hosts.equiv fixed that tho. and some (most?) distributions come
with localhost in there...
jeff
---
Why Linux? source code. POSIX. tcpip. job control. support from the authors.
drivers for most hardware. because one terminal or process is never enough.
forget the other O/Ss, i use Linux- the choice of a GNU generation.
