A Weakness in the 4.2BSD Unix TCP/IP Software


Published: Apr 10, 2000 Updated: Apr 10, 2000 Section: Network Security Library :: Auditing Author: Robert T. Morris Printable Version Adjust font size: Rating: 2/5 - 3 Votes 1 2 3 4 5

The 4.2 Berkeley Software Distribution of the Unix operating system (4.2BSD for short) features an extensive body of software based on the "TCP/IP" family of protocols. In particular, each 4.2BSD system "trusts" some set of other systems, allowing users logged into trusted systems to execute commands via a TCP/IP network without supplying a password. These notes describe how the design of TCP/IP and the 4.2 BSD implementation allow users on untrusted and possibly very distant hosts to masquerade as users on trusted hosts. Bell Labs has a growing TCP/IP network connecting machines with varying security needs; perhaps steps should be taken to reduce their vulnerability to each other.

Click Here to download this article