-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>>                                                      CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl.  Links  <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>>                                                                           <<
>> CERT-NL also has stopped the CERT-CC-Mirror service.  Due to this the     <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the  <<
>> complete CERT-CC advisory texts:                     http://www.cert.org  <<
===============================================================================
Content-Type: text/plain; charset=us-ascii


===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : Don Stikvoort                               Index  :    S-97-44
Distribution  : World                                       Page   :          1
Classification: External                                    Version:          1
Subject       : SGI IRIX ordist Buffer Overrun Vuln.        Date   :  30-May-97
===============================================================================

By courtesy of AUSCERT we received
information on an SGI IRIX ordist Buffer Overrun vulnerability.

This can lead to root compromises.

CERT-NL recommends taking action 3.1 mentioned below and wait -if possible-
for SGI's patches. SGI acknowledged this problem on May 28th:

<QUOTE>
Silicon Graphics Inc. acknowledges the ordist buffer overrun vulnerability publically reported by several individuals and in AUSCERT Advisory AA-97.23.

Currently, Silicon Graphics Inc. is investigating and no further information
is available for public release at this time.

As further information becomes available, additional advisories will be
issued via the normal SGI security information distribution methods
including the wiretap mailing list.
<UNQUOTE>

==============================================================================

AA-97.23                        AUSCERT Advisory
                  SGI IRIX ordist Buffer Overrun Vulnerability
                                 28 May 1997

Last Revised:   --

  ---------------------------------------------------------------------------

AUSCERT has received information that a vulnerability exists in ordist(1c),
distributed under IRIX 6.2.  Other versions of IRIX may also be vulnerable.

This vulnerability may allow local users to gain root privileges.

Exploit information involving this vulnerability has been made publicly
available.

At this stage, AUSCERT is unaware of any official vendor patches.  AUSCERT
recommends that sites apply the workaround given in Section 3 until vendor
patches are made available.

This advisory will be updated as more information becomes available.

  ---------------------------------------------------------------------------

1.  Description

    ordist(1c) is a program used to maintain identical copies of files over
    multiple hosts.  It preserves the owner, group, mode and mtime of
    a file if possible.

    Due to insufficient bounds checking on arguments which are supplied
    by users, it is possible to overwrite the internal stack space of the
    ordist program while it is executing.  By supplying a carefully designed
    argument to the ordist program, intruders may be able to force ordist to
    execute arbitrary commands.  As ordist is setuid root, this may allow
    intruders to run arbitrary commands with the privileges of root.

    Sites can determine if this program is installed by using:

  % ls -l /usr/bsd/ordist

    ordist is installed by default in /usr/bsd.  Sites are encouraged to check
    for the presence of this program regardless of the version of IRIX
    installed.

    Exploit information involving this vulnerability has been made publicly
    available.

2.  Impact

    This vulnerability may allow local users to gain root privileges.

3.  Workarounds/Solution

    AUSCERT recommends that sites prevent the exploitation of this
    vulnerability in ordist by immediately applying the workaround given in
    Section 3.1.

    If the ordist functionality is required by non-root users, AUSCERT
    recommends applying the workaround given in Section 3.2.

    Currently there are no vendor patches available that address this
    vulnerability.  AUSCERT recommends that official vendor patches be
    installed when they are made available.

3.1 Remove setuid and non-root execute permissions

    To prevent the exploitation of the vulnerability described in this
    advisory, AUSCERT recommends that the setuid permissions be removed
    from the ordist program immediately.  As ordist will no longer work for
    non-root users, it is recommended that the execute permissions for
    them also be removed.

  # ls -l /usr/bsd/ordist
  -rwsr-xr-x   1 root   sys     70564 Nov 28 15:07 /usr/bsd/ordist

  # chmod 500 /usr/bsd/ordist
  # ls -l /usr/bsd/ordist
        -r-x------   1 root   sys     70564 Nov 28 15:07 /usr/bsd/ordist

3.2 Install ordist wrapper

    AUSCERT has developed a wrapper to help prevent programs from being
    exploited using the vulnerability described in this advisory.  Sites
    which have a C compiler can obtain the source, compile and install
    the wrapper as described in Section 3.2.1.  For sites without a C
    compiler, AUSCERT has made pre-compiled binaries available
    (Section 3.2.2).

3.2.1 Installing the wrapper from source

    The source for the wrapper, including installation instructions, can
    be found at:

        ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/
                                               overflow_wrapper.c

    This wrapper replaces the ordist program and checks the length of the
    command line arguments which are passed to it.  If an argument exceeds
    a certain predefined value (MAXARGLEN), the wrapper exits without
    executing the ordist command.  The wrapper program can also be configured
    to syslog any failed attempts to execute ordist with arguments exceeding
    MAXARGLEN.  For further instructions on using this wrapper, please
    read the comments at the top of overflow_wrapper.c.

    When compiling overflow_wrapper.c for use with ordist, AUSCERT recommends
    defining MAXARGLEN to be 32.

    The MD5 checksum for the current version of overflow_wrapper.c can be
    retrieved from:

        ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM

    The CHECKSUM file has been digitally signed using the AUSCERT PGP key.

3.2.2 Installing the wrapper binaries

    A pre-compiled wrapper binary is provided for sites that wish to
    install the wrapper but do not have a C compiler available.  AUSCERT
    has compiled the wrapper on IRIX 5.3, however later versions of IRIX
    should be able to use the wrapper binary without recompilation.  The
    following compile time options have been used to create the binaries:

        REAL_PROG='"/usr/bsd/ordist.real"'
        MAXARGLEN=32
        SYSLOG

    More information on these options can be found in Section 3.2.1 and
    in the overflow_wrapper.c source code.

    The pre-compiled binary for the wrapper program can be retrieved from:

  ftp://ftp.auscert.org.au/pub/auscert/tools/
             AA-97.23-ordist_wrapper.tar.Z

    The MD5 checksum for AA-97.23-ordist_wrapper.tar.Z is:

        MD5 (AA-97.23-ordist_wrapper.tar.Z) = 0eed9d9a52658181a1ce9b4ce2ed7fd2

    AA-97.23-ordist_wrapper.tar.Z contains a README file with installation
    instructions, as well as a pre-compiled binary.

    Sites are encouraged to carefully read the installation notes in the
    README file before installation.

4.  Additional measures

    Most Unix systems ship with numerous programs which have setuid or
    setgid privileges.  Often the functionality supplied by these privileged
    programs is not required by many sites.  The large number of privileged
    programs that are shipped by default are to cater for all possible
    uses of the system.

    AUSCERT encourages sites to examine all the setuid/setgid programs
    and determine the necessity of each program.  If a program does not
    absolutely require the setuid/setgid privileges to operate (for example,
    it is only run by the root user),  the setuid/setgid privileges should
    be removed.  Furthermore, if a program is not required at your site,
    then all execute permissions should be removed.

    A sample command to find all setuid/setgid programs is (run as root):

       # find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -l {} \;

    It is AUSCERT's experience that many vulnerabilities are being discovered
    in setuid/setgid programs which are not necessary for the correct
    operation of most systems.  Sites can increase their security by
    removing unnecessary setuid/setgid programs.

    For example, the functionality provided by the ordist program is not
    needed by many sites.  If sites had previously disabled this program,
    they would not have been susceptible to this latest vulnerability.

==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
  http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

   Email:     cert-nl@surfnet.nl     ATTENDED REGULARLY ALL DAYS
   Phone:     +31 302 305 305        BUSINESS HOURS ONLY
   Fax:       +31 302 305 329        BUSINESS HOURS ONLY
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands

NOODGEVALLEN:    06 22 92 35 64      ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64      ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6IXjSYjBqwfc9jEQL5UgCdHrU7gJ0fmVjcoJxc4nPmyNzq0RYAoOy9
0+hY2JteaWFQNqvrq4giVpD0
=Nv0y
-----END PGP SIGNATURE-----