Executive brief
A vulnerability exists in the rwhod service, a legacy networking tool used to display who is logged into various machines on a local network. By sending a specially crafted network packet, a remote attacker can crash the service or potentially take control of the affected system. This could lead to unauthorized access to sensitive data or a complete disruption of the server's operations.
Technical details
The rwhod daemon is vulnerable to a classic stack-based buffer overflow. The flaw resides in the processing of incoming UDP packets, specifically when handling the hostname field. An attacker can send a maliciously crafted UDP packet to the rwhod port (typically 513) containing a hostname that exceeds the allocated buffer size. This allows for the overwriting of the stack, potentially leading to arbitrary code execution with the privileges of the rwhod process (often root). The vulnerability is reachable over the network without authentication.
Affected products
- IBM AIX
- BSD rwhod
Timeline
- 1996-08-21: disclosed: Vulnerability published in NVD