Re: Futile rexecd holes

[espel () clipper ens fr (Roger Espel Llima)]

> Vulnerability:
>         Rexecd allows redirection of stderr stream to an arbitrary port on
> the client machine.  This stream is opened by rexecd before authentication of
> the user.

[ ... ]

> Discussion:
>         Because rexec uses unprivileged ports for the whole process, any
> user can send a request to a rexecd requesting connection of the stderr stream
> to an arbitrary port on the client machine.  Since the client is unprivileged,
> there is no possibility for the legitimate stderr stream to be destined for a
> privileged port.

At least rexecd is sensible enough to make the connection to the
provided port from an unprivileged port too.  I'd say that this
``vulnerability'' doesn't let Joe Hacker do anything much that he
couldn't do already;  if somoene can use rexec on a remote host, they
can also execute netcat on it, and directly open connections to whatever
machine and port they want.  Still, it does provide an easy way to do
things like send mail from a machine w/o being logged on it.

Concerning rexec, I'd be more worried about the fact that most versions
of it allow anyone to check if an account exists (by having a different
message for "login incorrect" and "password incorrect"), and to execute
commands without much logging.  Since there is no standard rexec client
anyway (in the sense that rsh is one for the shell service, rlogin for
the login service, etc), there isn't much reason to keep rexec anyway.

And if we're going to worry about services that can be made to connect
to an arbitrary port on a host and send data to it, then the worst
offender is definitely ftp, with the infamous PORT command that lets you
choose not only to which port but also to which IP address the daemon is
going to send its data...  and for the same price, the connection comes
from a privileged port (ftp-data = 20) !  Good thing the r* commands are
smart enough to not consider ports between 0 and 512 privileged, but I
wouldn't be too surprised if some newer services out there that re-use
the (weak) concept of privileged ports could be abused by this.

        -Roger
--
e-mail: roger.espel.llima () ens fr
WWW page & PGP key: http://www.eleves.ens.fr:8080/home/espel/index.html