rsh Excessive Trust Vulnerability

2013-01-25T00:00:00
ID SAINT:E1D3EDA8CB6A3EAA4D9637839F914538
Type saint
Reporter SAINT Corporation
Modified 2013-01-25T00:00:00

Description

Added: 01/25/2013
CVE: CVE-1999-0515

Background

The **rsh** service allows remote users, using an **rsh** client, to execute individual shell commands on an **rsh** server without the need for a password. The **rsh** process uses the .rhosts file to list trusted hosts (those machines allowed to use the service).

Problem

CVE-1999-0515: The root user account on the target trusts every host and, as a result, a malicious superuser on an arbitrary host can gain access as root. Once inside, the intruder can replace system programs or configuration files (such as the password file) and take over the machine.
CVE-2012-6392: A specific case of the rsh excessive trust vulnerability. Cisco Prime LAN Management Solution (LMS) 4.1 through 4.2.2 on Linux does not properly validate authentication and authorization requests in TCP sessions, which allows remote attackers to execute arbitrary commands with the permissions of the root user via a crafted session on port 514/tcp.

Resolution

Remove the wildcard (+) from the /etc/hosts.equiv file and the .rhosts file in the root user's home directory. Ensure that these files contain only trustworthy hosts.
If the successfuly targeted machine is running Cisco Prime LMS, upgrade to version 4.2.3 or higher, or apply the appropriate patch as described in Cisco Security Advisory cisco-sa-20130109-lms.

References

<http://www.porcupine.org/satan/demo/docs/admin_guide_to_cracking.html#remote-shell-access>
<http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-lms>
<http://www.securityfocus.com/bid/57221>
<http://www.osvdb.org/show/osvdb/89112>

Platforms

Linux
Unix