[ Search ] [ What's New? ] [ About ]
[ Bugs ] [ Misc ] [ Mailing Lists ] [ Newgroups ] [ NewsWire ] [ Papers ] [ People ]
[ Pictures ] [ Publications ] [ Responce Teams ] [ Tools ] [ Upcoming Events ] [ Web Sites ]

telnetd(8)
Systems Affected: SunOS 4.1 and 4.1.1.
This vulnerability also affects SunOS 4.0.3 versions of both in.telnetd and in.rlogind.
Problem: The vulnerability allows a user on the system to gain unauthorized access to other accounts, including root.
Solution: SOLUTION for SunOS 4.0.3 and 4.0.3c:

Sun Microsystems, Inc. has patched versions of in.telnetd and in.rlogind available for SunOS 4.0.3 on all Sun 3 and Sun 4 architectures. The Sun Patch ID is 100125-03 which is needed when ordering the patch from a Sun Answer Center. In the US, telephone (800) USA-4SUN. The checksum of the compressed tarfile (filename 100125-03.tar.Z) is 17128 102. The compressed tarfile is available by anonymous FTP on uunet.uu.net (192.48.96.2) in sun-dist/100125-03.tar.Z. Please note: This compressed tarfile also includes patched versions of in.telnetd for SunOS 4.1 and 4.1.1. Please disregard these files.

SunOS 4.0.3 patch installation instructions are as follows: 

  # mv /usr/etc/in.telnetd /usr/etc/in.telnetd.FCS
  # mv /usr/etc/in.rlogind /usr/etc/in.rlogind.FCS
  # chmod 600 /usr/etc/in.telnetd.FCS
  # chmod 600 /usr/etc/in.rlogind.FCS
(These four steps store the old versions as a precaution and change the file modes so that the old versions cannot be executed. After verifying the new versions, the old versions should be removed.) 

  # cp sun{3,3x,4,4c}/{4.0.3,4.0.3c}/in.telnetd /usr/etc/in.telnetd
  # cp sun{3,3x,4,4c}/{4.0.3,4.0.3c}/in.rlogind /usr/etc/in.rlogind
(Be sure to copy the appropriate versions for your architecture.) 
  # chmod 711 /usr/etc/in.telnetd
  # chmod 711 /usr/etc/in.rlogind
  # chown root /usr/etc/in.telnetd
  # chown root /usr/etc/in.rlogind
  # chgrp staff /usr/etc/in.telnetd
  # chgrp staff /usr/etc/in.rlogind
  # kill {any executing in.telnetd and in.rlogind process(es) (SEE NOTE)}


NOTE: Be careful in killing existing in.telnetd and in.rlogind processes,
      as they may be legitimate users attempting to login to the system.

SOLUTION for SunOS 4.1 and 4.1.1:

Sun Microsystems, Inc. has patched versions of in.telnetd available for
SunOS 4.1 and 4.1.1 on all Sun 3 and Sun 4 architectures.  The Sun
Patch ID is 100125-03 which is needed when ordering the patch from a Sun
Answer Center. In the US, telephone (800) USA-4SUN.  The checksum of the
compressed tarfile (filename 100125-03.tar.Z) is 17128 102.  The compressed
tarfile is available by anonymous FTP on uunet.uu.net (192.48.96.2) in
sun-dist/100125-03.tar.Z.  Please note:  This tarfile includes patched
versions of in.telnetd and in.rlogind for SunOS 4.0.3.  Please disregard
these files.


Patch installation instructions are as follows:

  # mv /usr/etc/in.telnetd /usr/etc/in.telnetd.FCS
  # chmod 600 /usr/etc/in.telnetd.FCS


(These two steps store the old version as a precaution and change the
file mode to that the old version cannot be executed; after verifying
the new version, the old version should be removed.)

  # cp sun{3,3x,4,4c}/4.1/in.telnetd /usr/etc/in.telnetd


(Be sure to copy the appropriate version for your architecture.)

  # chmod 711 /usr/etc/in.telnetd
  # chown root /usr/etc/in.telnetd
  # chgrp staff /usr/etc/in.telnetd
  # kill {any executing in.telnetd process(es) (SEE NOTE)}


NOTE: Be careful in killing existing in.telnetd processes, as they may
      be legitimate users attempting to login to the system.

Aleph One / aleph1@underground.org
Copyright © 1996 Computer Underground Society. All rights reserved.