Executive brief
The rwho/rwhod service is an older networking utility used to display information about users logged into other machines on a local network. When this service is active, it automatically broadcasts system status and user activity, which can be intercepted by unauthorized parties. This allows an attacker to perform reconnaissance, identifying active users and system uptime, which could be used to plan further targeted attacks.
Technical details
The rwhod daemon maintains a database of the status of other machines on a local network by broadcasting and receiving UDP packets. This protocol lacks authentication and encryption, allowing any network-adjacent observer to collect sensitive information such as who is logged in, how long they have been idle, and system load averages. This is classified as an information disclosure vulnerability. To mitigate this risk, the rwhod service should be disabled on systems where it is not strictly required for legacy operations.
Affected products
- BSD-derived systems rwhod daemon
Timeline
- 1997-07-01: disclosed: NVD published date