Multiple Vendor Autofsd Vulnerability
BID:332
Info
Multiple Vendor Autofsd Vulnerability
| Bugtraq ID: | 332 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 21 1998 12:00AM |
| Updated: | Oct 21 1998 12:00AM |
| Credit: | This vulnerability was discovered by Mark Zielinski of RSI. It was posted to the Bugtraq mailing list by RSI Advise <[email protected]> on October 27, 1998. |
| Vulnerable: |
SGI IRIX 6.5.1 SGI IRIX 6.5 SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 IBM AIX 4.3 |
| Not Vulnerable: | |
Discussion
Multiple Vendor Autofsd Vulnerability
Autofsd is an RPC server which answers file system mount requests from the autofs file system. A vulnerability exists in the way autofsd processes map names when it receives a map request for an executable. Upon determining a file is executable, the server appends the client key and attempts to execute it. By sending a map name that is executable on the server (ie, any executable binary) and a key beginning with a semicolon or newline, followed by the commands to execute, arbitrary users can execute commands on the filesystem. Both IRIX 6.x and AIX 4.3 are vulnerable.
Autofsd is an RPC server which answers file system mount requests from the autofs file system. A vulnerability exists in the way autofsd processes map names when it receives a map request for an executable. Upon determining a file is executable, the server appends the client key and attempts to execute it. By sending a map name that is executable on the server (ie, any executable binary) and a key beginning with a semicolon or newline, followed by the commands to execute, arbitrary users can execute commands on the filesystem. Both IRIX 6.x and AIX 4.3 are vulnerable.
Solution / Fix
Multiple Vendor Autofsd Vulnerability
Solution:
Patches are available from both SGI and IBM to address this issue. The AIX patch is available from IBM support. It is patch number IX83752
SGI patches are available at http://support.sgi.com
OS Version Vulnerable? Patch # Other Actions
---------- ----------- ------- -------------
IRIX 6.2 yes 3392 Note 1
IRIX 6.3 yes 3391 Note 1
IRIX 6.4 yes 3250 Note 1
IRIX 6.5 yes 6.5.2 Note 2
IRIX 6.5.1 yes 6.5.2 Note 2
IRIX 6.5.2 no Note 3
NOTES
1) This version of the IRIX operating system is in maintenance mode and patches will no longer be produced when it retires. Use workaround.
2) IRIX 6.5.2 needs to be installed to remove this vulnerability.
3) If you have not received an IRIX 6.5.2 CD for IRIX 6.5, contact your SGI Support Provider or download the IRIX 6.5.2 Maintenance Release Stream from http://support.sgi.com/ or
Solution:
Patches are available from both SGI and IBM to address this issue. The AIX patch is available from IBM support. It is patch number IX83752
SGI patches are available at http://support.sgi.com
OS Version Vulnerable? Patch # Other Actions
---------- ----------- ------- -------------
IRIX 6.2 yes 3392 Note 1
IRIX 6.3 yes 3391 Note 1
IRIX 6.4 yes 3250 Note 1
IRIX 6.5 yes 6.5.2 Note 2
IRIX 6.5.1 yes 6.5.2 Note 2
IRIX 6.5.2 no Note 3
NOTES
1) This version of the IRIX operating system is in maintenance mode and patches will no longer be produced when it retires. Use workaround.
2) IRIX 6.5.2 needs to be installed to remove this vulnerability.
3) If you have not received an IRIX 6.5.2 CD for IRIX 6.5, contact your SGI Support Provider or download the IRIX 6.5.2 Maintenance Release Stream from http://support.sgi.com/ or