IRIX day5notifier Vulnerability
BID:345
Info
IRIX day5notifier Vulnerability
| Bugtraq ID: | 345 |
| Class: | Origin Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 16 1997 12:00AM |
| Updated: | May 16 1997 12:00AM |
| Credit: | This vulnerability was reported to the Bugtraq mailing list by Mike Neuman <[email protected]> on May 16, 1997. |
| Vulnerable: |
SGI IRIX 6.2 |
| Not Vulnerable: |
SGI IRIX 6.3 SGI IRIX 6.1 SGI IRIX 5.3 |
Discussion
IRIX day5notifier Vulnerability
A vulnerability exists in the day5notifier program, shipped with Irix 6.2 from Silicon Graphics Inc. This program will allow any user to run any command as root.
day5notifier wisely replaces a number of system() calls with execve() calls. However, the code was translated to run a copy of /bin/sh as the processor in the execve. As such, all the security problems associated with using a system() call in a setuid program remain.
A vulnerability exists in the day5notifier program, shipped with Irix 6.2 from Silicon Graphics Inc. This program will allow any user to run any command as root.
day5notifier wisely replaces a number of system() calls with execve() calls. However, the code was translated to run a copy of /bin/sh as the processor in the execve. As such, all the security problems associated with using a system() call in a setuid program remain.
Solution / Fix
IRIX day5notifier Vulnerability
Solution:
Removal of this program is highly recommended. Removing the setuid bit from this program is also an acceptable solution. Neither of these operations should affect the useability of the system, as this program is used solely for registering the OS installation with SGI.
A patch should be available at SGI support at http://support.sgi.com
Solution:
Removal of this program is highly recommended. Removing the setuid bit from this program is also an acceptable solution. Neither of these operations should affect the useability of the system, as this program is used solely for registering the OS installation with SGI.
A patch should be available at SGI support at http://support.sgi.com