Executive brief
A vulnerability in the rcp (remote copy) utility on older Linux systems allows a low-privileged user, such as the 'nobody' account, to overwrite sensitive system files. This occurs because the system incorrectly handles a specific user ID, failing to drop administrative privileges before performing file operations. An attacker could use this to gain full control over the server, potentially leading to complete data theft or system takeover.
Technical details
The rcp utility is setuid root to allow it to bind to privileged ports. When it attempts to drop privileges using setuid() for a user with UID 65535, the system call interprets 65535 as -1. Because -1 is also the error return value for these system calls, the privilege drop fails or is ignored, and rcp continues to execute with root privileges. An attacker with access to the 'nobody' account (often used by web servers like NCSA httpd) can exploit this to overwrite arbitrary files, such as /root/.rhosts, to gain full remote root access. This can be triggered locally or remotely if a web application allows execution of system commands.
Affected products
- Linux Foundation Linux Red Hat 4.0, Slackware 3.1
Timeline
- 1997-02-03: disclosed: Initial disclosure on Bugtraq mailing list
- 1997-02-03: advisory: NVD publication date