Executive brief
A vulnerability exists in the rlogin utility, a tool used for remote login and terminal access on various Unix-like operating systems. By providing a specially crafted terminal environment variable, an attacker can crash the system or potentially gain full control over the affected machine. This could lead to a complete compromise of the server, including unauthorized access to sensitive data and disruption of services.
Technical details
The rlogin utility is vulnerable to a classic buffer overflow (CWE-120) when processing the TERM environment variable. The program fails to perform adequate bounds checking on the size of the input provided via this variable before copying it into a fixed-size buffer. An attacker can exploit this by passing an excessively long string in the TERM variable, allowing them to overwrite the stack and redirect execution flow. This vulnerability is typically exploitable over the network without authentication, potentially leading to remote code execution with the privileges of the rlogin process (often root). Numerous legacy Unix and Unix-like operating systems are affected, including versions of AIX, FreeBSD, HP-UX, and Solaris.
Affected products
- BSDI BSD/OS 1.1, 2.0, 2.0.1, 2.1
- Debian Debian Linux 0.93
- Digital Ultrix 2.2, 3.0, 4.0, 4.1, 4.2, 4.3, 4.3a, 4.4, 4.5
- FreeBSD Project FreeBSD 1.1.5.1, 2.0, 2.0.5, 2.1.0, 2.1.5
- HP HP-UX 10.00, 10.01, 10.08, 10.09, 10.10, 10.16, 10.20, 10.24, 10.30, 10.34
- IBM AIX 3.2, 4.1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5
- NetBSD Foundation NetBSD 1.0, 1.1
- Oracle/Sun Solaris 2.4, 2.5.1, 2.6, 7.0, 8, 5.3, 5.4, 5.5, 5.5.1
Timeline
- 1997-02-06: disclosed: Initial publication date