US-CERT Vulnerability Notes Database CERT Statistics Vulnerability Disclosure Policy CERT Knowledgebase Courses

CERT^® Advisory CA-1991-06 NeXT rexd, /private/etc, Username me Vulnerabilities

Original issue date: May 14, 1991
Last revised: September 18, 1997
Attached copyright statement

A complete revision history is at the end of this file.

The Computer Emergency Response Team/Coordination Center (CERT/CC) and NeXT Computer, Inc. have received information concerning three vulnerabilities in NeXT computers running various releases (see below) of NeXTstep software. For more information, please contact your authorized support center. If you are an authorized support provider, please contact NeXT through your normal channels.

PROBLEM 1 Description

By default, rexd(8C) is enabled in NeXTstep versions 2.0 and 2.1.
(Note that no NeXT software uses rexd.)

PROBLEM 1 Impact

Leaving rexd enabled allows remote users to execute processes on a NeXT computer.

PROBLEM 1 Solution

Comment out or remove the rexd line in /etc/inetd.conf (unless you're using the remote execution facility), and either restart the computer or cause inetd to re-read it's configuration file, using:

kill -HUP <inetd pid>

PROBLEM 2 Description

The /private/etc directory is shipped with group write permission enabled in all NeXTstep versions through and including 2.1.

PROBLEM 2 Impact

Group write permission in /private/etc enables any user in the "wheel" group to modify files in the /private/etc directory.

PROBLEM 2 Solution

Turn off group write permission for the /private/etc directory, using the command:

chmod g-w /private/etc

or the equivalent operations from the Workspace Manager's Inspector panel.

PROBLEM 3 Description

Username "me" is a member of the "wheel" group in all NeXTstep versions through and including 2.1.

PROBLEM 3 Impact

Having username "me" in the "wheel" group enables "me" to use the su(8) command to become root (the user must still know the root password, however).

PROBLEM 3 Solution

Unless you have specific reason(s) not to, remove the user "me" from the wheel group.

The CERT/CC would like to thank NeXT Computer, Inc. for their response to this vulnerability. CERT/CC would also like to thank Fuat Baran for his technical assistance.

This document is available from: http://www.cert.org/advisories/CA-1991-06.html

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

http://www.cert.org/

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.

Conditions for use, disclaimers, and sponsorship information

Revision History

September 18,1997  Attached Copyright Statement

CERT® Advisory CA-1991-06 NeXT rexd, /private/etc, Username me Vulnerabilities