rsh Excessive Trust Vulnerability

Added: 01/25/2013
CVE: CVE-1999-0515

Background

The **rsh** service allows remote users, using an **rsh** client, to execute individual shell commands on an **rsh** server without the need for a password. The **rsh** process uses the .rhosts file to list trusted hosts (those machines allowed to use the service).

Problem

CVE-1999-0515: The root user account on the target trusts every host and, as a result, a malicious superuser on an arbitrary host can gain access as root. Once inside, the intruder can replace system programs or configuration files (such as the password file) and take over the machine.
CVE-2012-6392: A specific case of the rsh excessive trust vulnerability. Cisco Prime LAN Management Solution (LMS) 4.1 through 4.2.2 on Linux does not properly validate authentication and authorization requests in TCP sessions, which allows remote attackers to execute arbitrary commands with the permissions of the root user via a crafted session on port 514/tcp.

Resolution

Remove the wildcard (+) from the /etc/hosts.equiv file and the .rhosts file in the root user’s home directory. Ensure that these files contain only trustworthy hosts.
If the successfuly targeted machine is running Cisco Prime LMS, upgrade to version 4.2.3 or higher, or apply the appropriate patch as described in Cisco Security Advisory cisco-sa-20130109-lms.

References

<http://www.porcupine.org/satan/demo/docs/admin_guide_to_cracking.html#remote-shell-access&gt;
<http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-lms&gt;
<http://www.securityfocus.com/bid/57221&gt;
<http://www.osvdb.org/show/osvdb/89112&gt;

Platforms

Linux
Unix