what you don't know can hurt you

S-96-66.asc

S-96-66.asc
Posted Jan 10, 2000

Subject CDPlayer vuln. in SGI IRIX 5.x & 6.x Date 26-Nov-96

systems | irix
MD5 | 4fe5b20a181c5a8b06df870fbd2b33b8

S-96-66.asc

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>> CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl. Links <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>> <<
>> CERT-NL also has stopped the CERT-CC-Mirror service. Due to this the <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the <<
>> complete CERT-CC advisory texts: http://www.cert.org <<
===============================================================================
===============================================================================
Security Advisory CERT-NL
===============================================================================
Author/Source : Rene Ritzen Index : S-96-66
Distribution : World Page :
Classification: External Version:
Subject : CDPlayer vuln. in SGI IRIX 5.x & 6.x Date : 26-Nov-96
===============================================================================

By courtesy of AUSCERT, the Australian CERT, we received information on a
vulnerability in the SGI IRIX CDPlayer distributed with IRIX 5.x and 6.x.
This information is made publicly available by
AUSCERT Advisory AA-96.11, dated 22 Nov 1996.

CERT-NL recommends that sites apply the workaround which is given below.

Keywords: cdplayer, root permission
===============================================================================
AA-96.11 AUSCERT Advisory
SGI IRIX cdplayer Vulnerability
22 November 1996

Last Revised: --

- - ---------------------------------------------------------------------------

AUSCERT has received information that there is a vulnerability in the
"cdplayer" program distributed with IRIX 5.x and 6.x. cdplayer(1) is a
Motif based control panel used for playing audio compact disks.

This vulnerability may allow local users to gain root privileges.

Exploit details involving this vulnerability have been widely distributed.
This vulnerability can be exploited without a CD-ROM drive being attached
to the machine being attacked.

At this stage, AUSCERT is unaware of any official vendor patches. AUSCERT
recommends that sites apply the workaround given in Section 3 until vendor
patches are made available.

This advisory will be updated as new information becomes available.

- - ---------------------------------------------------------------------------

1. Description

cdplayer(1) is a program that creates a Motif based control panel used
for playing audio Compact Discs on a CD-ROM drive.

There is a vulnerability in cdplayer(1) that allows directories to be
created anywhere on the system. These directories are created using
root privileges with permissions following the umask of the person
running the program.

Exploit details involving this vulnerability have been made publicly
available. Sites should note that a CD-ROM drive does not need to be
attached for this vulnerability to be exploited.

This program may be installed under both IRIX 5.x and 6.x. By default,
it is installed under /usr/bin/X11/cdplayer. To determine whether
the cdplayer(1) program is installed, sites should check for its
presence with the command:

% ls -l /usr/bin/X11/cdplayer

If this program is installed, sites should take the actions recommended
in Section 3 immediately.

2. Impact

Local users may be able to create arbitrary directories anywhere on
the system. This may be leveraged to gain root privileges.

3. Workarounds/Solution

AUSCERT recommends that sites prevent the exploitation of the
vulnerability in cdplayer(1) by immediately applying the
workaround given in Section 3.1.

Currently there are no vendor patches available that address this
vulnerability. AUSCERT recommends that official vendor patches be
installed when they are made available.

3.1 Remove setuid and execute permissions

Until official vendor patches are made available, sites should remove
the setuid root and execute permissions from cdplayer(1). To do this,
the following command should be run as root:

# chmod 400 /usr/bin/X11/cdplayer
# ls -l /usr/bin/X11/cdplayer
-r-------- 1 root sys 127648 Jul 17 12:28 /usr/bin/X11/cdplayer

Note that this will remove the ability for users to run this program.
If the playing of audio compact disks is essential, sites may wish to
consider using cdman(1).
==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS
Phone: +31 302 305 305 BUSINESS HOURS ONLY
Fax: +31 302 305 329 BUSINESS HOURS ONLY
Snailmail: SURFnet bv
Attn. CERT-NL
P.O. Box 19035
NL - 3501 DA UTRECHT
The Netherlands

NOODGEVALLEN: 06 22 92 35 64 ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64 ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6IPTSYjBqwfc9jEQJj7ACgxiAHS3+VsCZWL7lh8w7iLy/aWj4AoP4S
CfnLj0Yij3NneNiRupfk4/hj
=jNe5
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    0 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close