Multiple Vendor at(1) Vulnerability
BID:331
Info
Multiple Vendor at(1) Vulnerability
| Bugtraq ID: | 331 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 27 1998 12:00AM |
| Updated: | Jun 27 1998 12:00AM |
| Credit: | This vulnerability was intially reported via a NetBSD security advisory sent by <[email protected]> on June 27, 1998 to the Bugtraq mailing list. J.A. Gutierrez <[email protected]> noted its existance on IRIX on July 3, 1998 on the Bugtraq |
| Vulnerable: |
SGI IRIX 6.5.1 SGI IRIX 6.5 SGI IRIX 6.4 SGI IRIX 6.2 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 NetBSD NetBSD 1.2.1 NetBSD NetBSD 1.2 NetBSD NetBSD 1.1 NetBSD NetBSD 1.0 |
| Not Vulnerable: |
SGI IRIX 6.3 NetBSD NetBSD 1.4 x86 NetBSD NetBSD 1.3.3 |
Discussion
Multiple Vendor at(1) Vulnerability
A vulnerability exists in NetBSD version 1.3.2 and lower, and Silicon Graphics Inc's IRIX versions 6.2, 6.3, 6.4, 6.5 and 6.5.1. The at(1) program can be supplied with a -f flag, and an error is access validation can result in the mailing of portions of unreadable files to any user who can run at.
At uses seteuid to set the appropriate user id to run under. However, it incorrectly sets its real and effective uid to 0 prior to opening the filename passed to the -f flag. This allows any user to read any file on the filesystem.
A vulnerability exists in NetBSD version 1.3.2 and lower, and Silicon Graphics Inc's IRIX versions 6.2, 6.3, 6.4, 6.5 and 6.5.1. The at(1) program can be supplied with a -f flag, and an error is access validation can result in the mailing of portions of unreadable files to any user who can run at.
At uses seteuid to set the appropriate user id to run under. However, it incorrectly sets its real and effective uid to 0 prior to opening the filename passed to the -f flag. This allows any user to read any file on the filesystem.
Solution / Fix
Multiple Vendor at(1) Vulnerability
Solution:
Removal of the setuid bit from at will prevent this vulnerability. It will also prevent at from functioning properly. Patches are available from SGI's support website at http://support.sgi.com.
The appropriate patches are as follow:
OS Version Patch #
---------- -------
IRIX 6.2 3182
IRIX 6.4 3184
IRIX 6.5 3286
IRIX 6.5.1 3286
Patches were issued for NetBSD versions 1.3.2 and prior. They are available at:
ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/19980626-at
Solution:
Removal of the setuid bit from at will prevent this vulnerability. It will also prevent at from functioning properly. Patches are available from SGI's support website at http://support.sgi.com.
The appropriate patches are as follow:
OS Version Patch #
---------- -------
IRIX 6.2 3182
IRIX 6.4 3184
IRIX 6.5 3286
IRIX 6.5.1 3286
Patches were issued for NetBSD versions 1.3.2 and prior. They are available at:
ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/19980626-at