TUCoPS :: Unix :: General :: xyplex1.htm

Vulnerability
 Xyplex
Affected
 Those running Xyplex terminal server
Description
 Aleksandr Pilosov has found Xyplex terminal server bug. If
 terminal server configured for RADIUS authentication, PPP/CHAP and
 AutoProtocolDetect, typing Ctrl-Z in username> prompt will drop
 you directly to command line, as if you logged in correctly.
 This will not work to get past 'enable' password, though.
 There is no information if Xyplex fixed that bug yet, but at least
 the following version of software is affected: TS/720 V6.0.1S1
 Rom 4C0000 HW 00.02.01 Lat Protocol V5.2
 Hardware Type: 76
 Hardware Revision: 00.02.01
 Midplane Type: SwitchPlane
 Rom Revision: 4C0000
 Software Type: Terminal Server Level 4
 Software Revision: V6.0.1S1
 Protocol Type: LAT, TELNET, RLOGIN, TN3270, SNMP, PPP
 Matthew G. Harrigan added following. The ctl-z concept can also
 be applied by simply entering a "?" at the 'Username:' prompt.
 Two things happen:
 1. The logged in user information is set to "???", which leads to
 believe that with some creativity and/or source code,
 unauthorized (resource challenged) users may be able to force
 an administrative shell.
 2. You are dropped into the command shell in which you are able
 to utilize all the client programs (i.e. rsh, telnet, etc..).
Solution
 New info expected. If you have this terminal server - test it.
 If you find yourself vulnerable to these attack, contact your
 vendor for more information how to protect yourself.
 Not tested to see if this fix problem, but perhaps if you try
 "REQUIRED"ing whatever option you have turned on instead of just
 "ENABLED"ing it, this may fix your problem. If radius is enabled
 and a person enters an invalid login/password sequence and radius
 fails authentication then it works properly, but if radius just
 fails with another type of error and since radius is only enabled,
 not required, you get default access (whatever that may be?).