CVE-1999-0113

Step 1: Establish Connection: The attacker initiates an rlogin connection to the vulnerable server.

Step 2: Parameter Injection: The attacker crafts an rlogin command that includes the -froot parameter. This parameter is designed to specify the initial login shell.

Step 3: Authentication Bypass: The vulnerable rlogin implementation, due to a lack of proper input validation, interprets the -froot parameter as a request to log in as the root user.

Step 4: Privilege Escalation: The system grants the attacker root privileges without proper authentication.

Step 5: Root Access Granted: The attacker now has full control over the system.

The vulnerability stems from insufficient input validation within the rlogin service. Specifically, the service fails to properly sanitize the -f parameter, which is intended to specify the user's initial login shell. By providing the -froot parameter, an attacker can bypass authentication and gain root privileges. The root cause is a lack of proper checks on the input provided to the rlogin service, allowing the attacker to manipulate the execution flow and elevate their privileges. This is a classic example of a privilege escalation vulnerability due to inadequate parameter handling.