rsh Excessive Trust Vulnerability
Added: 01/25/2013CVE: CVE-1999-0515
Background
The rsh service allows remote users, using an rsh client, to execute individual shell commands on an rsh server without the need for a password. The rsh process uses the .rhosts file to list trusted hosts (those machines allowed to use the service).Problem
CVE-1999-0515: The root user account on the target trusts every host and, as a result, a malicious superuser on an arbitrary host can gain access as root. Once inside, the intruder can replace system programs or configuration files (such as the password file) and take over the machine.CVE-2012-6392: A specific case of the rsh excessive trust vulnerability. Cisco Prime LAN Management Solution (LMS) 4.1 through 4.2.2 on Linux does not properly validate authentication and authorization requests in TCP sessions, which allows remote attackers to execute arbitrary commands with the permissions of the root user via a crafted session on port 514/tcp.
Resolution
Remove the wildcard (+) from the /etc/hosts.equiv file and the .rhosts file in the root user's home directory. Ensure that these files contain only trustworthy hosts.If the successfuly targeted machine is running Cisco Prime LMS, upgrade to version 4.2.3 or higher, or apply the appropriate patch as described in Cisco Security Advisory cisco-sa-20130109-lms.
References
http://www.porcupine.org/satan/demo/docs/admin_guide_to_cracking.html#remote-shell-accesshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-lms
http://www.securityfocus.com/bid/57221
http://www.osvdb.org/show/osvdb/89112
Platforms
LinuxUnix
Back to exploit index