From: fwp@CC.MsState.Edu (Frank Peters)
Subject: Re: SunOS Security Hole?
Keywords: security
Organization: Computing Center, Mississippi State University
Date: Mon, 28 Sep 1992 00:15:08 GMT

In article <1992Sep27.183306.21669@panix.com> brian@panix.com (Brian Childs) says:
: I think I have found a security hole in either SunOS or PC-NFS,

What you have found is a security hole in the way that your server is
configured.  Arguably PC-NFS should not behave in the way that it does...
but even that wouldn't prevent someone from writing their own rsh that
does whatever they like.

: here's whats happening:
: 
: 1. I am evaluating PC-Xview (a package which makes a pc emulate an
:    X-server).  
: 2. I have configured PC-Xview to access my sun using RSH
:    as user 'brian'
: 3. I logon to the pc as user 'rd'

What, exactly, do you mean by 'log in to the PC'?  Is the RSH program
part of the same package that enforces the login process?

In other words, if you are using a PC-NFS 'login' function and an
RSH that shipped with PC-Xview there isn't necessarily any reason
to expect them to talk to each other.
 
: not only does PC-Xview magically open a window onto account 'brian' without
: any type of authorization, but it will do the same for every account on the
: machine.

All rsh does is connect to a server using a priviledged port ('priviledged'
being a concept that is basically meaningless on a PC) and say "this is
user bob, run this command as user mary."  The server then decides whether
or not to honor this request.  Your PC rsh is apparently sticking the
target userid (brian in your case) in both the local and remore user slots.
The server has absolutely no way of detecting it and takes the PC's word
for it because you have TOLD it to take the PC's word for it.

There is nothing magic about RSH either.  The protocol is very simple
and moderate programmer could write his or her own even if the one 
shipped with your software behaved the way you wanted.

: None of the accounts have a .rhosts file, and hosts.equiv has only only line
: containing a '+' in it (which allows users of the SAME account password free
: access to any other machine on our lan).

This is a VERY bad idea.  This server isn't on the internet is it?

You shouldn't have a machine authorized in your hosts.equiv unless it
(1) enforces authentication and priviledge control and (2) you
absolutely trust the person or people who administer it.  The server
cannot check the authorization on the remote machine (unless you are
running some sort of security enhanced system) and must simply take the
machine's word for it.  Taking a PC's word for anything is a risky
proposition.

: as a test, I logged directly onto our sun server as 'rd' and tried 
: 'rsh workstation -l brian' and got a permission denied!

Note that I indicated both authentication AND priviledge control
above.  Your PC appears to use an authentication process but it doesn't
do anything to enforce priviledges...anyone sitting at the PC can run a
program that does anything that person wishes.  Once again, even if the
rsh that shipped with your software did the 'right' thing someone could
write their own version that does the 'wrong' thing.

And your server has been told to trust that PC and, by extension,
everyone that uses that PC.

: my question is why is it that PC-Xview can do it, and SunOS can't

The root user on the Sun CAN do it.  The problem is that EVERYONE 
sitting at the PC is, in effect, root on that PC.

: by the way NCD (the makers of PC-Xview) and SUN are too busy pointing
: the finger at each other to be any help.

They should both be pointing the finger at your poorly thought out
security environment.  That is where the real problem lies.
Newsgroups: comp.sys.sun.admin