[ Search ] [ What's New? ] [ About ]
[ Bugs ] [ Misc ] [ Mailing Lists ] [ Newgroups ] [ NewsWire ] [ Papers ] [ People ]
[ Pictures ] [ Publications ] [ Responce Teams ] [ Tools ] [ Upcoming Events ] [ Web Sites ]

selection_svc(1)
Systems Affected: SuOS 3.5, 4.0, 4.0.1, 4.0.3, 4.1 running the SunView windowing system. SunBug ID 1039576.
Problem: Under SunOS running the SunView windowing system, it is possible to remotely access files using SunView selection_svc(1) subprocess and the RPC facility. The selection_svc program handles all selections made by SunView client programs. It is used to modify resource files and cut/paste selections. The way these clients communicate with selection_svc is though RPC calls. The problem is that the selection service process will accept RPC requets from any user, both locally and remotely. No authentification is performed. Whats worts it is possible to scan for local systems having the RPC service available. The command: 'rpcinfo -b selection_svc 6' will print a list of systems running selection_svc on the local broadcast network. For Sun's 386i systems, the problem is more complicated. On these systems, selection_svc is starded when /etc/init runs /etc/rc. Because init runs as root, you tell selection_svc to read any file.
Solution: Dissable suntools and use the X11 windowing system, or apply Sun patch 100085-03.

Aleph One / aleph1@underground.org
Copyright © 1996 Computer Underground Society. All rights reserved.