exploit the possibilities

S-96-66.asc

S-96-66.asc
Posted Jan 10, 2000

Subject CDPlayer vuln. in SGI IRIX 5.x & 6.x Date 26-Nov-96

systems | irix
MD5 | 4fe5b20a181c5a8b06df870fbd2b33b8

S-96-66.asc

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>> CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl. Links <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>> <<
>> CERT-NL also has stopped the CERT-CC-Mirror service. Due to this the <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the <<
>> complete CERT-CC advisory texts: http://www.cert.org <<
===============================================================================
===============================================================================
Security Advisory CERT-NL
===============================================================================
Author/Source : Rene Ritzen Index : S-96-66
Distribution : World Page :
Classification: External Version:
Subject : CDPlayer vuln. in SGI IRIX 5.x & 6.x Date : 26-Nov-96
===============================================================================

By courtesy of AUSCERT, the Australian CERT, we received information on a
vulnerability in the SGI IRIX CDPlayer distributed with IRIX 5.x and 6.x.
This information is made publicly available by
AUSCERT Advisory AA-96.11, dated 22 Nov 1996.

CERT-NL recommends that sites apply the workaround which is given below.

Keywords: cdplayer, root permission
===============================================================================
AA-96.11 AUSCERT Advisory
SGI IRIX cdplayer Vulnerability
22 November 1996

Last Revised: --

- - ---------------------------------------------------------------------------

AUSCERT has received information that there is a vulnerability in the
"cdplayer" program distributed with IRIX 5.x and 6.x. cdplayer(1) is a
Motif based control panel used for playing audio compact disks.

This vulnerability may allow local users to gain root privileges.

Exploit details involving this vulnerability have been widely distributed.
This vulnerability can be exploited without a CD-ROM drive being attached
to the machine being attacked.

At this stage, AUSCERT is unaware of any official vendor patches. AUSCERT
recommends that sites apply the workaround given in Section 3 until vendor
patches are made available.

This advisory will be updated as new information becomes available.

- - ---------------------------------------------------------------------------

1. Description

cdplayer(1) is a program that creates a Motif based control panel used
for playing audio Compact Discs on a CD-ROM drive.

There is a vulnerability in cdplayer(1) that allows directories to be
created anywhere on the system. These directories are created using
root privileges with permissions following the umask of the person
running the program.

Exploit details involving this vulnerability have been made publicly
available. Sites should note that a CD-ROM drive does not need to be
attached for this vulnerability to be exploited.

This program may be installed under both IRIX 5.x and 6.x. By default,
it is installed under /usr/bin/X11/cdplayer. To determine whether
the cdplayer(1) program is installed, sites should check for its
presence with the command:

% ls -l /usr/bin/X11/cdplayer

If this program is installed, sites should take the actions recommended
in Section 3 immediately.

2. Impact

Local users may be able to create arbitrary directories anywhere on
the system. This may be leveraged to gain root privileges.

3. Workarounds/Solution

AUSCERT recommends that sites prevent the exploitation of the
vulnerability in cdplayer(1) by immediately applying the
workaround given in Section 3.1.

Currently there are no vendor patches available that address this
vulnerability. AUSCERT recommends that official vendor patches be
installed when they are made available.

3.1 Remove setuid and execute permissions

Until official vendor patches are made available, sites should remove
the setuid root and execute permissions from cdplayer(1). To do this,
the following command should be run as root:

# chmod 400 /usr/bin/X11/cdplayer
# ls -l /usr/bin/X11/cdplayer
-r-------- 1 root sys 127648 Jul 17 12:28 /usr/bin/X11/cdplayer

Note that this will remove the ability for users to run this program.
If the playing of audio compact disks is essential, sites may wish to
consider using cdman(1).
==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS
Phone: +31 302 305 305 BUSINESS HOURS ONLY
Fax: +31 302 305 329 BUSINESS HOURS ONLY
Snailmail: SURFnet bv
Attn. CERT-NL
P.O. Box 19035
NL - 3501 DA UTRECHT
The Netherlands

NOODGEVALLEN: 06 22 92 35 64 ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64 ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6IPTSYjBqwfc9jEQJj7ACgxiAHS3+VsCZWL7lh8w7iLy/aWj4AoP4S
CfnLj0Yij3NneNiRupfk4/hj
=jNe5
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

January 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    8 Files
  • 2
    Jan 2nd
    11 Files
  • 3
    Jan 3rd
    11 Files
  • 4
    Jan 4th
    2 Files
  • 5
    Jan 5th
    2 Files
  • 6
    Jan 6th
    18 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    10 Files
  • 10
    Jan 10th
    13 Files
  • 11
    Jan 11th
    2 Files
  • 12
    Jan 12th
    4 Files
  • 13
    Jan 13th
    21 Files
  • 14
    Jan 14th
    18 Files
  • 15
    Jan 15th
    12 Files
  • 16
    Jan 16th
    18 Files
  • 17
    Jan 17th
    11 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close