-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>>                                                      CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl.  Links  <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>>                                                                           <<
>> CERT-NL also has stopped the CERT-CC-Mirror service.  Due to this the     <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the  <<
>> complete CERT-CC advisory texts:                     http://www.cert.org  <<
===============================================================================
===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : Rene Ritzen                                 Index  :    S-96-66
Distribution  : World                                       Page   :
Classification: External                                    Version:
Subject       : CDPlayer vuln. in SGI IRIX 5.x & 6.x        Date   :  26-Nov-96
===============================================================================

By courtesy of AUSCERT, the Australian CERT, we received information on a
vulnerability in the SGI IRIX CDPlayer distributed with IRIX 5.x and 6.x.
This information is made publicly available by
AUSCERT Advisory AA-96.11, dated 22 Nov 1996.

CERT-NL recommends that sites apply the workaround which is given below.

Keywords:       cdplayer,  root permission
===============================================================================
AA-96.11                        AUSCERT Advisory
                         SGI IRIX cdplayer Vulnerability
                                22 November 1996

Last Revised: --

- - ---------------------------------------------------------------------------

AUSCERT has received information that there is a vulnerability in the
"cdplayer" program distributed with IRIX 5.x and 6.x. cdplayer(1) is a
Motif based control panel used for playing audio compact disks.

This vulnerability may allow local users to gain root privileges.

Exploit details involving this vulnerability have been widely distributed.
This vulnerability can be exploited without a CD-ROM drive being attached
to the machine being attacked.

At this stage, AUSCERT is unaware of any official vendor patches.  AUSCERT
recommends that sites apply the workaround given in Section 3 until vendor
patches are made available.

This advisory will be updated as new information becomes available.

- - ---------------------------------------------------------------------------

1.  Description

    cdplayer(1) is a program that creates a Motif based control panel used
    for playing audio Compact Discs on a CD-ROM drive.

    There is a vulnerability in cdplayer(1) that allows directories to be
    created anywhere on the system.  These directories are created using
    root privileges with permissions following the umask of the person
    running the program.

    Exploit details involving this vulnerability have been made publicly
    available.  Sites should note that a CD-ROM drive does not need to be
    attached for this vulnerability to be exploited.

    This program may be installed under both IRIX 5.x and 6.x.  By default,
    it is installed under /usr/bin/X11/cdplayer.  To determine whether
    the cdplayer(1) program is installed, sites should check for its
    presence with the command:

 % ls -l /usr/bin/X11/cdplayer

    If this program is installed, sites should take the actions recommended
    in Section 3 immediately.

2.  Impact

    Local users may be able to create arbitrary directories anywhere on
    the system.  This may be leveraged to gain root privileges.

3.  Workarounds/Solution

    AUSCERT recommends that sites prevent the exploitation of the
    vulnerability in cdplayer(1) by immediately applying the
    workaround given in Section 3.1.

    Currently there are no vendor patches available that address this
    vulnerability.  AUSCERT recommends that official vendor patches be
    installed when they are made available.

3.1 Remove setuid and execute permissions

    Until official vendor patches are made available, sites should remove
    the setuid root and execute permissions from cdplayer(1).  To do this,
    the following command should be run as root:

        # chmod 400 /usr/bin/X11/cdplayer
 # ls -l /usr/bin/X11/cdplayer
 -r--------  1 root  sys  127648 Jul 17 12:28 /usr/bin/X11/cdplayer

    Note that this will remove the ability for users to run this program.
    If the playing of audio compact disks is essential, sites may wish to
    consider using cdman(1).
==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
  http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

   Email:     cert-nl@surfnet.nl     ATTENDED REGULARLY ALL DAYS
   Phone:     +31 302 305 305        BUSINESS HOURS ONLY
   Fax:       +31 302 305 329        BUSINESS HOURS ONLY
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands

NOODGEVALLEN:    06 22 92 35 64      ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64      ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6IPTSYjBqwfc9jEQJj7ACgxiAHS3+VsCZWL7lh8w7iLy/aWj4AoP4S
CfnLj0Yij3NneNiRupfk4/hj
=jNe5
-----END PGP SIGNATURE-----