Home page logo

bugtraq logo Bugtraq mailing list archives

Re: Small problem in AIX write command: Executes shell
From: dholland () EECS HARVARD EDU (David Holland)
Date: Fri, 1 Aug 1997 14:34:17 -0400

At least on our AIX 4.1.5, the "write" command for sending messages to
other users doesn't filter the message to be sent w.r.t. shell
metacharacters: Just pipe a "telnet localhost chargen" into "write
somebody", and you will receive error messages saying that a "sh" tries
to execute parts of the text being sent. Modify the input to "write" a
little bit (to contain actual shell commands), and they will be

This is because some versions of write, apparently including that one,
support shell escapes for the user typing into them.


Now, if write is installed setgid tty (as is customary, though I don't
know about AIX) it'd be interesting to know if the resulting shell
inherited group tty or not.

I think this is not related to the "writesrv" bug described in IX69168
(a buffer-overflow-based root exploit in "writesrv", the daemon for
handling "write" requests).

Off-topic: does anyone have documentation of the network protocol AIX
write uses? Reply in private mail...

   - David A. Holland             |    VINO project home page:
     dholland () eecs harvard edu    | http://www.eecs.harvard.edu/vino

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]