IRIX fam service Vulnerability
BID:353
CVE-1999-59 |Info
IRIX fam service Vulnerability
| Bugtraq ID: | 353 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 14 1997 12:00AM |
| Updated: | Jul 14 1997 12:00AM |
| Credit: | This vulnerability was first published in a Secure Networks, Inc. (SNI) advisory on June 14, 1997. |
| Vulnerable: |
SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 5.3 |
| Not Vulnerable: | |
Discussion
IRIX fam service Vulnerability
IRIX workstations commonly run a service known as "fam" (file alteration monitor). This service allows any user to obtain a complete listing of files and directories on vulnerable systems.
The fam service, RPC program 391002, is used by other programs to keep track of file modifications. When a program initially connects to the fam server, it passes the fam server the name of a file or directory to watch. If the fam server is passed a directory, it immediately gives the client a complete list of files and subdirectories in that directory. By passing the fam server a request to monitor the root directory, and following subdirectories from there, an attacker can remotely obtain a complete list of files on the system.
IRIX workstations commonly run a service known as "fam" (file alteration monitor). This service allows any user to obtain a complete listing of files and directories on vulnerable systems.
The fam service, RPC program 391002, is used by other programs to keep track of file modifications. When a program initially connects to the fam server, it passes the fam server the name of a file or directory to watch. If the fam server is passed a directory, it immediately gives the client a complete list of files and subdirectories in that directory. By passing the fam server a request to monitor the root directory, and following subdirectories from there, an attacker can remotely obtain a complete list of files on the system.
Exploit / POC
IRIX fam service Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
IRIX fam service Vulnerability
Solution:
A suitable temporary solution may be to disable the fam service. It is executed by inetd. Simply comment out the entry in /etc/inetd.conf, make sure all instances of fam are killed, and restart inetd.
On March 1, 2000, SGI released an advisory on this vulnerability. Fix information was contained within it.
Solution:
A suitable temporary solution may be to disable the fam service. It is executed by inetd. Simply comment out the entry in /etc/inetd.conf, make sure all instances of fam are killed, and restart inetd.
On March 1, 2000, SGI released an advisory on this vulnerability. Fix information was contained within it.