COMMAND
jidentd
SYSTEMS AFFECTED
Linux with jidentd 1.0
PROBLEM
On the Linux Security Audit Project mailing list there has been
some discussion about anecdotal evidence of machines being
exploited via various identd daemons. Chris Evans looked over
some of the commonly used identd daemons and found a likely
remote-exploitable buffer overrun in jidentd 1.0 by Josh Lehan.
Mitchell Blank looked over the code and found several other
potential problems - some serious, some not. Included is a patch
for all the problems Chris and Mitchell Blank spotted.
Jidentd is linux-specific. There is a copy in the contrib area
of RedHat's FTP site. It is apparently popular among the irc
crowd due to its ability to provide fake responses to queries. It
is believed that it often is run as root. When run in standalone
mode it provides no mechanism to drop privilege after binding its
socket. The code is, frankly, pretty messy.
SOLUTION
It is recommended not to use jidentd if possible. If you must run
it consider applying this patch. Also, run it from inetd and NOT
AS ROOT! Patch:
---
Content-Type: application/octet-stream; name="jidentd.patch.gz"
Content-Transfer-Encoding: base64
Content-Disposition: inline; filename="jidentd.patch.gz"
Content-MD5: zsLWc7p5oxeCArcm4JlDJA==
H4sICOxT+TUAAGppZGVudGQA3DxrV9vIkp89v6LNPQk2yGD5hQ1x5hJsEp9lDANksrPJHI6w
2lgbWfJIMgw3N/99q6ofatkyj5BkMzeHgNTP6np1VXW1XG88ZpVRxP7Xc3mQuBV7q7otn7dG
Zunmyf75wZu07qeNjY38XoWzecD251esVmXV5m69sVuvMbvTaf5UqVTuGrLwjrvsjM8Y6zC7
vWvv7Dbb2LGNc5n/aG7btuwWo1ccF187DJ4qPzFW6HlxEnmX88QLg+1ROLuNvKtJsssGbOY7
I86SiRezWRReRc6UzQOXR1DEsSdb8e/18C07mV/63ogdeSMexJyVrmssjJjvJDwqQ9+N7Z82
2fZG4YyP5pGX3LKZk4wmPGaO68LKLm/Z1IOCf157l1thdMXsauWsf1LBFW4xNgwZD9wwivkU
0AEjsY1COM5CCrPdOFHkBDC4N535Hne3qOU2TA8//3D52As4Ozk9fj3c/6XP1iRy14zK3/qn
Z4PjIVsDEqzlorZmWzUDtbWGVa8q1P7DC0b+3OXsRXwbbyfelG9NXi6V3zheslge8ASmT7a9
AGs2jRonmjnbWLc0VOJ6YU6hDxhcLnWiKyzNXVHHqjfSFdXrVr2TuyI/vFoceXbjLk3mXQWO
v7gMHkWBhNZA99Fg//RwcAS02ObJSHO77zmRSZU3g14/p9nEA94J8snUsK1mNV1Uo2W1anpR
ctjhMasar7/3z5iN8CHcY6pKbmccakEKcFXAp6OJE7FD37naKxS2N9i1E3nOpc+pYSxYLb/P
q9uE7+XVxpMwSti7MHJzq/0wuGK/zh2oBbC4H3P4q1pdXMzb7E5wFtsKMDKloCjE7JlSUEvp
rIHrjQXhvCBhZ+HoI08OexY7CIOAj+ARQQelMh8lLIZakOnowguopWi1l0uknbrVtgWRxDLY
vn/j3MZHHmddII9YlUNlzLkOPZfNYw8QEnHHZ4Ez5T8LnFPf33h0GcZmzxvQNJy5PHE8H3Dp
BeOQJSETrGx2PY/myWQ8942+rhcTKuexc8UZKBtkyjGMsw1sx/GBBigK8r6RZe9fvT08G/xP
/489HANLCMzYaHokx0mbqprzg5OFCsI5rbsfuCVE/ilPDkKXo0qFCc5DdsnZKARuiROQCYtN
nGvU4FyrRd8JXDbhEWf8mke3DLUS8xL259xLCCwUj3bT6tSVePxnEQJGUupjbyUJoJFSRSup
AW2gSDT5HnTJ3ddrVctuVJXI4J587VzEiRMlJdDwscXGYTR1kjKBWGGIv8T5CKA4EeEOWoOg
zsdjSyIfaoL1BMALXJ/mR46gfr0Q2HZ4fA7Y4KOPODALAdKxH94UZavreBbB4selsyRSU1sM
AQEAoB60aOkk8kLa8LuA4+PXF/3T0zLWfcJfxFWuy2B3gOFBTpDGFnNhaoRqeWY5cQGUzchJ
xLxrbE1MlymFZxq11I+isqj/TI0QaSsAY//+Nytp7u3SjvD8OVtsORgeHiOhC4UCdOjxy/nV
0bXPXrKqKBWY1RMAhM/iNYsBWGXkLpo92wsKC2OJS9isAXDo1IW52DO3y57FHwLon44nRmJy
MUBT0NAliXbGPgubr16zbLARpVDfwyrfFCebSO1NQe3HcyN2vI4Dk9Ni718cuudxHbZeyXZY
KSDJZTwGHWHOsRRAakeqYAOaAT+J0QviBdRBhsVkpTcusRrbxDqfByXRtpwWIOnYC2MFAioF
Vg5jL5fLQWXVZ/ojfj+I/Vbw3+MZsIgitZoLcxVYYwc8kx2lwAqoPm3ZnjQWKdV9sB/OQ5ik
hDYIvVpCKW8QxiqoY8GsAKUApHJYvVa5BMINTpCmERATNxcHUY57VIlvXW2BRV/rbLWaW3a1
umW3OmtloUpIDaH9w17ZFntVg/91+N8Qew8MM0WGhcG5E9+SKpI6T3SXutKJ4/kU57rh68Da
YPr8cvaqMvaATqwEtvtNGH0sg5MDmyBMxaOi0qCvbOAjXB97+RJ8CVJTr2pQVlKFdqvMnrPq
X4eHorJuVrazdQ01mFEoIUSVyoIwV6cKRpQQZVT62rPJfMv4D0yQRVN5D1GAilVtiK95chSO
EAraFw97cks89Hw/RsxAreNj/fYJWr60938SKqvVtOwd6U3lcs8O6LSdtuYecGV5ae0gnPsu
qo0rnoC9DKOzSRgnaJXsrgk9qecEBAVJOPFLaJr25tPp7RbYMRfINlsx/TE6EHyiQ7zQYQZV
QgJSXtWTWGKNQwBAjNaTOG0CRqmK+JSB8/oM9DCO1QXkkozpnvLxREyk5AOxtANYamtr7YdA
AkhaMJrdlgzo0WW9gF5OzixlCzsxVpJqUHer2KwsRtRF75calRkgAc2x9Q/V9a+L31yma7cs
u1O7i+kiPg1BtBcRfkrFj8G46PFIvkunsZh4zuc8UbcaNWlf9SyQU8hwXwdjSZ27uO//AxuK
Ac01PIYD034pC6Zl75eb3c2ET0Z1bpymtmPV6nXFiKRtD8ABS7jwyEtYIrXtGYeNcT7Tvjop
fC8YhbRLjYTf7oF/ovQvmqWgrofz6RG5LLEyC2GwEU3CnIANgoRHgFby8rlU3gU9SVeWl/YP
wSDsn4OhcHzwXxdn56f9/V8sMDT2RMys3rBqDR01+8YLsVjCp7NvtJxcOtVbsDzbjBHWrVrT
TgOwklNgB10Tk0mYXDBn3e4zl3hEgZEV5Db0eUdGxhWs3WFJJKwSZC+m2GuA8TGt2dAyRBTA
emyyGWPAKQwezpJSGss5Oz66wOWJZV6c9t+e9fd7vVOLPcfOyugu4UuZbE+JzksPHFkwkMBW
Qv8WfO3huQAnRSfJ3diZev4tmigCnXuZWkP6oclgiHNf7A9/X4HjZseqdapZWfC5Ex2B1Jv8
Q4Vod8zmCbsEV4NHJqtc/otHYWmAta/m4IZIZ1/gnIpPyNRXLUgx0AuIrQPWTFd1QX2gwiRo
VCFRgLuATZ0EWXX49uhI2rDbSsqL0mSKnMsM5xdNzncMLmfw42S49RO5bhiVA/IgxwoqLQfj
tJ+ng3bQ2hmNeIYLFjuyjfJz7ABcgBMIvKD/kI7yQjkQtBOcROGlz6dy5KyM0k5QxGUXDCtR
jyS0LtQAanNqsLInfRvlcYIwDJZ1ARtH4ZSR05PZDxcG6PVfvX0NI7yNd6ExCg97Uam8ZOcT
PlUlGYtBuEnabFitxiW0qGuQ/Za5DypTbk3NjyLFVw95MppQjTCgleuDRZKrT7njguMDggee
B58CxtENwgZozIvpCAmOiEG6PB5F3iwBngSKEePQKFPwAWIS2yRyPB/ReHC6fXQoOnuJbrqP
Dg40NaBehyl9UFvuLbvkPADX3cfYnowo1loooI2sjv8KAio3YlXwGEEtLfb9MpFFonyhxFZY
tRt+tFjF7o4pEvqDifAnIceGjPRPT62HyHShEPFkHgWwNBkXgF+yqPoI/raoBT4d8eBvwex5
u1O9alt1dQDLEK9Mhl3eOV5yGBqqzWLn3pSH86TMil0VQNTIrNExQiJawGxQRcimVmB0B2gZ
I1jmgEoa5JPgfxkvFHTHfi/0bJ/EcNrE6IBO7Acu4oeQC/TBHsouoe5yuMKUT8nvI9KlUqoF
srIgqaA+oen7nPrUli7KgZFepeUxV41O3UyJ3wSRv6/potJgIoankaQpYvI3FdBRHJ2XVptW
vaat2a9ObB2yM8nJXrKSlJKKXWbl5dV3lRSRlvvPZ5iF/fRRZMyVYTwWrzdTtz9dr12FBb8B
hXF0aLEANg4xKKwf1qtmX7XS/EWKVd65wByRwPabzAadL5/KeUOnuAOBuL+lIT35jVkWldU9
mTZQB3wZgYEfGV8GO53os5TvgalcTqvvWPVG3eA0ZEo8jChtkH7CZUXrZdQOB+CP3XDYeSj1
RegJ0efTKqSrLiSeCfYRWM8iicT/PvxQSWUZW5VctGxKxmjAZtjYMRjjB1seKsgvX2IuRZtV
q97saIp+lnabqTAHhsGrQ/EYAdDCwW4mTgJrA08/XdMKKUn9VoydomwYbqkWDHHu5QXxPHKC
EZeeyBe4ubgYydRi11pYh2EwEws0G1Y9zb/5DvhQFmSKD2M3vAcfizvJAxeaxwgNu2E1ajrF
hZg4zwU942L7zBxH7goX9pz/JeM4wqUccg9s2IhR/hsHSZInNvGKox3AR1GuTJ3tEIrwbIdZ
5PbuMrDzj08ZzvghEmd94Mi+4REXT+eYqGAJCdDw0AZLmR2mMSG8NHHYiUqQTB3zPSdqLNJD
smexySQK51cTsteF+0SuBiVz2TuAVe1bPh2r+nTZdDHxWWiRvyemcvmx1rIa9dqD+RHj98hD
XTwDht+wXH22cDdDvT3rnw56+DAc/HcuugSOUpylI39tdM1jHtFKHsJbYPY16q0H89a9GHoE
a/0dcZbLZQ2QT2P7W/BwRmom9EOEy65ydLE6/ujN2MyJMREDz8996eirhjKBZnzFk7hkbn4W
njHzMpICIzflhakX9pyWDqT7YfgRSUnhH9Kog5P1eJexZ23/L/EbqSC9kfSQNz3QUtYDwnYz
ASDugK5oQCeMGgXRDkB0gCocgNllH9aA/GtEfmV4CgZt2laj1UrNqW+MXINlF/GrI0bjkY/Z
QSWq31vE++byhv/dkL8M/VPwn8vsO6BS200j1bhdtxpp5BNtxufPGR6Ni5PMrhbnMiZS4ZGl
WUGCLQXzU9bPbgCAPS/C5Pkw9C0W+i6bOgHYPUBHylIpAsaE0/0W5HfQUzlCgkAmfTLBuYLI
4yEqQful1iYAv4dz9svg7KzfK5IRZtqC4FUjkwUhqQ+g6TxwlYWUi7tO02pWtXkkErecOM4X
YVvrVHnYi2sUwXfqVHnJZjcXARVggr8yVzNWXBqMRFo1qw2raacnc18PABVsVk3KEhLorYre
5zdimVPlJbDz8Ni0a1azVk0VLhvEpLjZLVALI9JAB9/jeEaHJdKpIpGkvPoNpDXNR0WoDLpA
vhlsEypXFkgfraX5iyXRSKKJkgTv18iG0GXjMCJlsVmDZZghhC9cBrCwiChHPH7UojJrStVb
Tmi7IOLbMY54h7ahDllxEkdDOBt1X9JGi4jJpXetDvTuZOQGJn1v7OzSz0FOCtYFG+e30KyW
yePxuCsYm9byUGlqAP0anYw0fUuwdGaQLDZkTBW9z23zBRJWB4wbJs0pdYpZtQucFlxxVxiC
FbtLfzHRTmi/Sq0L1jqzu5isLsIa2KJonN6arCuzFyhsSW/EyGfRiBaj6PCHxXpxki1S8Ykl
XlcZ8YrXWR6vLxgS5BcLLwPtCNqgU1Pi0VZOUeT+9lbnIBaVi6qD1HE8cgLtWcTCa5OI0Ms3
ElplqBfTWWlbJZ6Zzkq6S6qsFc5IMVXLInguoDSCxlBny7i6Qo3Y3mBvwysFvf6wgha7AjyH
SyWUSwJUXLkBy3j/wn6aZSkdckBa08HqSRSOQE0OkpLQe4OgLASyWbda1dQU+cZce8rjuW+w
7YbG/YbGxMbMYqPvy6sCLJhDKvBHG4lILsyeUYExOQIrbcxIlbF1sQHK1w8JvJfZDKOD+uxG
VwYLjavUeBQGiRfMBS4LEm8w5cyYUI5SlDMik8tXmtF8D+iduqo7mqJOzaeBG8EkG3IWBMmI
oAu4R+aI+pVGMeVGD5iB9QHY+SzPnJPsijXSMrOr96Xpn46g+xD1eRlFGtA7dM2ShUcqZ1Hj
KG1e/UMzhaiUbVIetlVk+xKY/aN8+XyvArpjqyykm2V+s4VzFQ1KVRZISLJabNHoURIrdcQX
q7XczbkFm3OrnbpgrWrbaqUBwvTKjxPFlKITl2Cs9Az2k7w2UoIpUqkUEO+pmyvnqAXh54Yu
bSX0G7YCF63RS84cmfda4X/N/NBLqBvLBIyjOYafk8k8xtMPmApGwwt0/i1d87Tg95XqpgfY
VrBJGwkBfwmOSzVznWUpZ6PHEz5K8AIpeIYwgUzKlcAxJ8E8vkRlShXXrEymFI2JdzNqItNv
U9E2NxamQ0d0WTxO0EynWD0g6ZbFPEiUO425iepkGSNofbo+szYY/rZ/NOhVTo5Pz9cyAYT8
AFOr2bFa6S2SNIEmcZJ5avLrsyKAcUjHjnJ7wEWLGFYxdWKRScUAwNtpjkrmnFykmgkIpcqR
XV6mvITQp6xrdELW3LGb1k69nokvLoK+uTI/bnNlfpwg0tPy4zafmh+3qYM09+THCWhX58dt
LpzCbLJvSU8jq+xpBM7l1Rbw6o6RRwCrRuML/VnQAuLCkBvi8RV+wUDdH8LbtT6v/DnHu6HT
0OXK20U9ppYF2wFurWfU9ldqKm7oyWwHY494DGd/NnWm7EgpFMTAdWDgRhoy+aHXs4KyKxeY
R8Adu0MSqwgYzhK0jbvScg8xI84VO7O+cxvzBPEBxqyDeyXao/oaeIX8WdynU2tX3VAu7xnV
aZBC3U3OVMv7yZa6lUyVBt+Wjmck7F28lIG53vvR1chi8Psa5Cf+07kOJsnubNfb9XfHu+7u
mjgd6B8f5sRGa1LkZoLtUerWn43WWelZXKZ4I23RZTGlPNtA1DiRRHkhvsHve5TMdpkg58gB
t2o9Xt9l4ulsfVfwWxv4zQin3o3+H2/53S6lkf7M1tZ22ZMxksugzaq106qZmUq4dVd1ToMQ
Gzo7Psa7Cwdv+j2dWCHG9vQsA5hFwK/MyZRNBfiWmQuwMIk5pq/HPFoaM+Xtx4051mMeLo2p
BeJxQyZ6yHMYUrQSeiE6D4fzaUkN93wheY8+nGDbVrvWMoP93xj3ykRXNbQ6ne+iP3+Q2ywT
93o6zVJvQVRkQdEfWchtdj8ojyG1mkKWZwFRH3LIa3Q/GF/MHrmiSsrM+C5Nu9Gx2s1mJk3+
F8cLjsJwprPkSR/MPPciYYdh9JHTV1nIalQBbr2Z/Tr3kv0xaEhz4/yUD0sHpq4ahkl6l5sS
XXwwqHBHhz0Vj4CjW8yzYk7E0dIfAxyoBTe2RX6qkRBf3tP3jWVuelkxfC9M22AjqU65yO4m
jzHO3sUimDBfrCDQ1WpY7R3D+HgKzOBTmWAjxip2ORd4YqTsMbmoVt7Kk1aWR512dcdq242U
OiLmBPCJlKWxF+AxvQ98orArtw2Cn7wxYFqVTSyyBS7nlD914wR0XSvmPthLAOHtjXOrl2lm
Lqe3CqqSrelrLo5H2MQPl2hdJtBzFk55MkEsT5zZjOMXjMR+jH2guKjzPTWwSBYWjsfgQY+g
KfnT8gMQmGtguC2YEi26mZ7AOUyEE9ZAGug81Nna2hJegGQa/MxQu50yzXdDpTggykPmXh4e
NfqZPBqyVWJ3IRsfTBsZaeSPIID06GXIS0YQDJSiWFziGIJjDXyqb1zkCI78UEUK6Xckc64E
2W2rXW/lpdUKLSpDcUzE2QQO0SUl6FK2NkzAA6pyAMxrLhxN+qLMgvpTHcPFkoxl8DmFaQmE
GWqsJB+GE1EngLAEtOsxOxn06KaxOP0XC9TgxT7ns1JTv+N1mP2DPjs4HvYG5/i9O2Tqn39m
7J1iaSRJSqZrLnvCNjRC1IFzs0C1y1tM7QaHK0S5EGKTRLeqHwxDHEDpQxj4M7o6V7DjATX1
gj8XzGgiyXCnZnWquUnEDyOmZE4KSmZv1t5P469ITwMMlonfPJXQOXjLFYpGk+wNJRR3RM1q
FDySGBSSGiGRMIEfo3s/6xzcEw8dMFQwYKSUKjbeNKMxLfZuePxmf/g6PWKntkJfUNzfvDMq
VRQdDNK0gAB1v0yTGwdItZ6pIQTl5M4LCGIuNI2VPhTawmLQX9+jA9KAEuXqg0Pq4iGSmj5i
GJdk1K5jt6xOGrX7OmhT21CaaPBQROZh0jhNoG8tYl3/4M3gqFdm5lnBgzEuTxWMqdSHggwj
+Uvxb+SEPYgI7l3fYnXDu77GCrXE+it6fukXWbGr+U3W1i78NGqrv8naqlkt/ema/xsE5IIm
mkHHlIJDAgh0M8FjRcBghoBQYKK3AYnYKSRCti4qwQ69UwJtlSwuAa3yA/ZpMI7PRJgJBCFA
jTB9oMIDNm0BmQWGLNaCjE+Bd6sWpBbpgsWSEoszi0HjeAgXJwLLcJBcMchBStATOPUgsy5g
D0KzCE09CLGWzl4EAAZ08AsPWAAA
-----