SGI IRIX NSD AUTH_UNIX GID List Privilege Escalation Vulnerability

Bugtraq ID:	8304
Class:	Boundary Condition Error
CVE:	CVE-2003-0575
Remote:	Yes
Local:	No
Published:	Jul 29 2003 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	Discovery is credited to LSD.
Vulnerable:	SGI IRIX 6.5.21 m SGI IRIX 6.5.21 f SGI IRIX 6.5.21 SGI IRIX 6.5.20 m SGI IRIX 6.5.20 f SGI IRIX 6.5.20 SGI IRIX 6.5.19 m SGI IRIX 6.5.19 f SGI IRIX 6.5.19 SGI IRIX 6.5.18 m SGI IRIX 6.5.18 f SGI IRIX 6.5.18 SGI IRIX 6.5.17 m SGI IRIX 6.5.17 f SGI IRIX 6.5.17 SGI IRIX 6.5.16 SGI IRIX 6.5.15 SGI IRIX 6.5.14 SGI IRIX 6.5.13 SGI IRIX 6.5.12 SGI IRIX 6.5.11 SGI IRIX 6.5.10 SGI IRIX 6.5.9 SGI IRIX 6.5.8 SGI IRIX 6.5.7 SGI IRIX 6.5.6 SGI IRIX 6.5.5 SGI IRIX 6.5.4 SGI IRIX 6.5.3 SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5
Not Vulnerable:

SGI IRIX NSD AUTH_UNIX GID List Privilege Escalation Vulnerability

SGI has reported a vulnerability in IRIX that may permit attackers to gain remote root privileges via the nsd server and modules. The problem is a heap overflow in the RPC AUTH_UNIX functionality of the nsd service.

SGI IRIX NSD AUTH_UNIX GID List Privilege Escalation Vulnerability

It has been disclosed that a functional exploit for this issue is available. However, this exploit has not yet been publicly released.

SGI IRIX NSD AUTH_UNIX GID List Privilege Escalation Vulnerability

Solution:
SGI has addressed this issue with patches 5189-5197. Users should contact the vendor to obtain fixes.

SGI IRIX NSD AUTH_UNIX GID List Privilege Escalation Vulnerability

References:

• [LSD] IRIX nsd remote buffer overflow vulnerability (Last Stage of Delirium )