Signature Detail

TELNET: Exploit LD_PRELOAD

This signature detects attempts to exploit a known vulnerability in TELNET that allows remote clients to specify environment variables. Attackers can place a shared object library containing executable code on the system, set this library as a LD_PRELOAD environment variable, and open a TELNET connection with the target host. When TELNET executes the /bin/login during user authentication, the dynamic linker loads the library listed in the PRELOAD, thus bypassing normal system libraries and allowing the attacker to execute code as root.

Extended Description

A vulnerability existed in a number of in.telnetd's, that when coupled with dynamic linking introduced a very serious vulnerability. Telnet supports the passing of environment variables from a remote host. On vulnerable systems, an attacker would place a shared object containing code they are sure will be run, for instance, the crypt() function on the system. This could be via ftp, nfs, or any other method for getting a file on the system. They would then set this library to be part of their LD_PRELOAD enviroment variable. Upon telneting into the machine, when telnet exec'd /bin/login to authenticate the user, the system dynamic linker would load the library listed in the preload, which would override the normal library call. This in turn could allow a user to execute code as root.

Affected Products

• Digital OSF/1 1.2.0
• Digital OSF/1 1.3.0
• Digital OSF/1 2.0.0
• Digital OSF/1 3.0.0
• Digital OSF/1 3.2.0
• Digital UNIX 3.2.0 G
• Digital UNIX 4.0.0
• SGI IRIX 5.0.0
• SGI IRIX 5.0.1
• SGI IRIX 5.1.0
• SGI IRIX 5.1.1
• SGI IRIX 5.2.0
• SGI IRIX 5.3.0
• SGI IRIX 5.3.0 XFS
• SGI IRIX 6.0.0
• SGI IRIX 6.0.1
• SGI IRIX 6.0.1 XFS
• SGI IRIX 6.1.0
• SGI IRIX 6.2.0
• SGI IRIX 6.3.0

References

• BugTraq: 459
• CERT: CA-1995-14
• CVE: CVE-1999-0073