Signature Detail

TELNET: Exploit SGI _RLD

This signature detects attempts to exploit known runtime linker vulnerability in TELNET on systems running Silicon Graphics IRIX. Attackers can place a shared object library containing executable code on the system, set this library as a _RLD environment variable, and open a TELNET connection with the target host. When TELNET executes the /bin/login during user authentication, the dynamic linker loads the library listed in the _RLD, thus bypassing normal system libraries and allowing the attacker to execute code as root.

Extended Description

A vulnerability existed in a number of in.telnetd's, that when coupled with dynamic linking introduced a very serious vulnerability. Telnet supports the passing of environment variables from a remote host. On vulnerable systems, an attacker would place a shared object containing code they are sure will be run, for instance, the crypt() function on the system. This could be via ftp, nfs, or any other method for getting a file on the system. They would then set this library to be part of their LD_PRELOAD enviroment variable. Upon telneting into the machine, when telnet exec'd /bin/login to authenticate the user, the system dynamic linker would load the library listed in the preload, which would override the normal library call. This in turn could allow a user to execute code as root.

Affected Products

• Digital osf/1 1.2.0
• Digital osf/1 1.3.0
• Digital osf/1 2.0.0
• Digital osf/1 3.0.0
• Digital osf/1 3.2.0
• Digital unix 3.2.0 G
• Digital unix 4.0.0
• Sgi irix 5.0.0
• Sgi irix 5.0.1
• Sgi irix 5.1.0
• Sgi irix 5.1.1
• Sgi irix 5.2.0
• Sgi irix 5.3.0
• Sgi irix 5.3.0 XFS
• Sgi irix 6.0.0
• Sgi irix 6.0.1
• Sgi irix 6.0.1 XFS
• Sgi irix 6.1.0
• Sgi irix 6.2.0
• Sgi irix 6.3.0

References

• BugTraq: 459
• CERT: CA-1995-14
• CVE: CVE-2000-0733
• URL: http://www.cert.org/advisories/CA-1995-14.html
• URL: http://www.securityfocus.com/archive/1/75864
• URL: http://www.securityfocus.com/bid/459/discuss