IRIX /usr/lib/netaddpr Vulnerability
BID:330
Info
IRIX /usr/lib/netaddpr Vulnerability
| Bugtraq ID: | 330 |
| Class: | Race Condition Error |
| CVE: |
CVE-1999-1410 |
| Remote: | No |
| Local: | Yes |
| Published: | May 09 1997 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This vulnerability was reported to the Bugtraq mailing list on May 9, 1997 by Jaechul Choe <[email protected]>. |
| Vulnerable: |
SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0.1 XFS SGI IRIX 6.0.1 SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1.1 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 |
| Not Vulnerable: | |
Discussion
IRIX /usr/lib/netaddpr Vulnerability
SGI's IRIX 5.x and 6.x operating system include a utility called /usr/lib/netaddpr. This program can be used by privledged users to add network printing devices to the system. A race condition exists in this program that could allow any "privledged" user to obtain root access.
The netaddpr program is shipped setuid root. As part of its execution, it creates a file in /var/tmp with the file template printersXXXXXX. Because the creation of the file and the actual opening of the file are independant events, there exists a window, during which time an attacker can replace the file with a symbolic link. By making this link point to, for instance, /.rhosts, an attacker can elevate their privledges to that of root.
SGI's IRIX 5.x and 6.x operating system include a utility called /usr/lib/netaddpr. This program can be used by privledged users to add network printing devices to the system. A race condition exists in this program that could allow any "privledged" user to obtain root access.
The netaddpr program is shipped setuid root. As part of its execution, it creates a file in /var/tmp with the file template printersXXXXXX. Because the creation of the file and the actual opening of the file are independant events, there exists a window, during which time an attacker can replace the file with a symbolic link. By making this link point to, for instance, /.rhosts, an attacker can elevate their privledges to that of root.