[8619] in bugtraq
IRIX chost/gr_osview vulnerabilities
daemon@ATHENA.MIT.EDU (Klaus)
Mon Nov 23 22:54:37 1998
Date: Fri, 20 Nov 1998 13:55:27 -0500
Reply-To: Klaus <klaus@IMPRINT.UWATERLOO.CA>
From: Klaus <klaus@IMPRINT.UWATERLOO.CA>
To: BUGTRAQ@NETSPACE.ORG
Hello,
The SGI osview GUI tools are victim to another familiar Un*x security bug.
Problem:
^^^^^^^^
When invoked by a privileged user, the osview tools (available under the
/usr/Cadmin/bin/chost GUI or System -> System Manager from the toolchest
app.) will create predictable files in /var/tmp, with mode 0777.
These tools create files in /var/tmp using the syntax
"IP-address.osview.system".
for instance,
-rwxrwxrwx 1 root sys 12 Nov 20 13:13 192.24.42.12.os.cpu
-rwxrwxrwx 1 root sys 34 Nov 20 13:13 192.24.42.12.osview.disk
-rwxrwxrwx 1 root sys 107 Nov 20 13:13 192.24.42.12.osview.gen
-rwxrwxrwx 1 root sys 31 Nov 20 13:13 192.24.42.12.osview.net
Scope:
^^^^^^
A clever user can dupe a sysadmin into overwriting any supposedly
protected file on the system, such as, say, /etc/passwd, or /unix...
along with it, the associated mayhem.
symlink an important file to one of those, wait for a privileged user to
run the appropriate program, and...
aruba 60# more /etc/passwd
disk(/)
disk(/disk2)
disk(/disk6)
aruba 61#
Solution:
^^^^^^^^^
These files are created to instruct gr_osview what quantities to monitor
on a running system. Apart from waiting for SGI to change the way
gr_osview opens/creates files (O_CREAT|O_EXCL|O_RDONLY) on the open, and
a less generous creation mask (0444 would do just as well), the only
solution is to disable gr_osview entirely. I'm not sure if any other SGI
admins use it, but I find it handy once in a while. This bug was tested on
an Indy running 6.2; I haven't tried it on our other systems (Challenges,
O2, Origins) running different versions of IRIX, but I'd be willing to bet
they're also vulnerable.
Klaus
--
TODO:
1) learn how to use my new Unix account.
2) learn how to change this list.
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2
mQCNAzWQQ7QAAAEEALulvoUfgDSsm9FkcznQ4z4EZrjBlPPcNqLm9HKD2QSEcJKU
7ewiIVKEPkQc0PLRlsedwv8VN4TruzNhsIigHmRkBoyb4UYLIVRDXqirhJmsvkaW
f0/ahkd+sy35AAiWi8xu0tSISbd8P5sHr5l+1tJH2Z/mQ8OkZBfiXzM9H40RAAUT
tA9LbGF1cyBQLiBTdGVkZW6JAJUDBRA1kEkoF+JfMz0fjREBAVIeBACnEmwA+sLS
RmWadyEtI9vL9FT+qv6o77sm0AptBy+ZAnCK20V1TyjwyTs1nHSkfWJxABx9zWUH
DtMN3vZ/2Q/mnYDUcJEwH/p2e29ETYA7ss/eRBOW4DQ226uYN2R2HTtFB8ZhWS4a
1UovSLmVDsk0FX5q7DXkGToVRl/u9boK4Q==
=KfVd
-----END PGP PUBLIC KEY BLOCK-----
