[2870] in SIPB-AFS-requests
installed new telnetd on some sipb server machines
daemon@ATHENA.MIT.EDU (mhpower@MIT.EDU)
Wed Oct 22 04:40:35 1997
From: mhpower@MIT.EDU
To: rtfm-maintainers@MIT.EDU, usenet@MIT.EDU, sipb-afsreq@MIT.EDU
Date: Wed, 22 Oct 1997 04:40:14 EDT
Because of tonight's "SNI-20: Telnetd tgetent vulnerability" security
advisory, I modified telnetd on bloom-picayune, penguin-lust,
bloom-beacon, senator-bedfellow, ronald-ann, and reynelda so that the
TERMCAP environment variable can't be set by telnetd. As far as I can
tell, tgetent on SunOS and Ultrix doesn't depend on the values of
TERMINFO, TERMPATH, or HOME. I've included a more detailed explanation
of the problem below...
Matt
------- Forwarded Message
From: mhpower@MIT.EDU
To: net-defense@MIT.EDU
Cc: yert@MIT.EDU
Subject: potential for breakins via telnetd tgetent problem
Date: Wed, 22 Oct 1997 04:06:00 EDT
Message-Id: <9710220806.AA19846@yaz-pistachio.MIT.EDU>
This afternoon Secure Networks Inc. released an advisory about a
security problem in telnetd on some systems. The problem potentially
allows people anywhere on the Internet to login remotely as root
without needing any account on your system.
You can read their advisory at http://www.mit.edu:8008/menelaus/bt/5424
to see their claims about what operating systems are and aren't
vulnerable. However, a number of systems widely used here, such as
SunOS 4, Ultrix, and Digital Unix, are not listed one way or the other.
(Linux and Solaris 2.x are listed in the "not vulnerable" category.)
As far as I know, exploiting this security problem would require that
the telnetd on your system allows the client to propagate certain
environment variables across the telnet connection -- these
environment variables are the ones that can force telnetd to access a
nonstandard termcap file. Different systems may use different
environment variables for this, but often the relevant ones are
limited to TERMCAP, TERMINFO, TERMPATH, and HOME. Most versions of
telnetd allow these environment variables to be propagated, but don't
allow some other variables such as LD_LIBRARY_PATH to be propagated.
So, one possible workaround is to add TERMCAP, TERMINFO, TERMPATH, and
HOME to the list of disallowed environment variables in the source
code for your telnetd, and then rebuild and reinstall telnetd. If
you're using a standard Kerberos V4 telnetd such as the one in the CNS
distribution, the function to change is envvarok in the file state.c.
The side effect of the change is that users won't be able to specify a
nonstandard termcap file prior to logging in. In most environments,
this won't present a major problem, although it's possible that some
users will be inconvenienced by the change.
Matt
------- End of Forwarded Message
