IRIX eject Vulnerability

Bugtraq ID:	351
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	May 25 1997 12:00AM
Updated:	May 25 1997 12:00AM
Credit:	This bug was reported to the Bugtraq mailing list on May 25, 1997 by David Hedley <[email protected]> SGI released a security advisory on this vulnerability on November 16, 1997.
Vulnerable:	SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0.1 XFS SGI IRIX 6.0.1 SGI IRIX 6.0
Not Vulnerable:	SGI IRIX 6.3

IRIX eject Vulnerability

A vulnerability exists in the eject program shipped with Irix 6.2 from Silicon Graphics. By supplying a long argument to the eject program, it is possible to overwrite the return address on the stack, and execute arbitrary code as root. Eject is normally used to eject removeable media from the system, and as such is setuid root to allow for any user at the console to perform eject operations.

IRIX eject Vulnerability

x

• /data/vulnerabilities/exploits/irix-eject1.c
• /data/vulnerabilities/exploits/irix-eject2.c

IRIX eject Vulnerability

Solution:
A suitable temporary solution is to remove the setuid bit from the executable: chmod -s /usr/sbin/eject

Patches are available for this vulnerability from http://support.sgi.com
OS Version Vulnerable? Patch #
---------- ----------- -------
IRIX 3.x unknown not avail
IRIX 4.x unknown not avail
IRIX 5.0.x yes not avail
IRIX 5.1.x yes not avail
IRIX 5.2 yes not avail
IRIX 5.3 yes 2228
IRIX 6.0.x yes not avail
IRIX 6.1 yes not avail
IRIX 6.2 yes 2177
IRIX 6.3 yes 2232
IRIX 6.4 yes 2233

IRIX eject Vulnerability

References:

• SGI Support (Silicon Graphics Inc.)