IRIX login Vulnerability
BID:392
Info
IRIX login Vulnerability
| Bugtraq ID: | 392 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 26 1997 12:00AM |
| Updated: | May 26 1997 12:00AM |
| Credit: | This vulnerability was discovered by David Hedley <[email protected]>, and was reported to the Bugtraq mailing list on May 26, 1997. |
| Vulnerable: |
SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0 SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1 |
| Not Vulnerable: | |
Discussion
IRIX login Vulnerability
A buffer overflow exists in the /bin/login program supplied by Silicon Graphics, as part of their Irix operating system. By supplying a carefullly crafted, log buffer to the -h option of login, a local user can obtain root privileges.
A buffer overflow exists in the /bin/login program supplied by Silicon Graphics, as part of their Irix operating system. By supplying a carefullly crafted, log buffer to the -h option of login, a local user can obtain root privileges.
Exploit / POC
Solution / Fix
IRIX login Vulnerability
Solution:
A suitable temporary solution is to remove the setuid bit from the login binary. This should not prevent users from logging in to the machine, but will prevent users from using the login account to change from one account to another once logged in. chmod -s /bin/login
Please go to SGI support at http://support.sgi.com> for official patches from Silicon Graphics for this any other vulnerabilities.
Solution:
A suitable temporary solution is to remove the setuid bit from the login binary. This should not prevent users from logging in to the machine, but will prevent users from using the login account to change from one account to another once logged in. chmod -s /bin/login
Please go to SGI support at http://support.sgi.com> for official patches from Silicon Graphics for this any other vulnerabilities.