TUCoPS :: SGI :: ciace033.txt

SGI Help

            _____________________________________________________
                       The U.S. Department of Energy
                    Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
            _____________________________________________________

			       ADVISORY NOTICE

		 Vulnerabilities in the SGI IRIX Help System

August 11, 1994 1700 PST                                         Number E-33
_____________________________________________________________________________ 

PROBLEM:        Vulnerabilities in the SGI Help system allows unauthorized
                access to a root shell. 
PLATFORM:       SGI IRIX 5.x.
DAMAGE:         Unauthorized users can access a root shell without logging in. 
SOLUTION:       Retrieve and install the patches, or apply the workarounds
                described below. 
_____________________________________________________________________________ 

VULNERABILITY   These vulnerabilities have been widely discussed on many
ASSESSMENT:     public forums on the Internet. Attack scripts have been
                created and distributed. Vulnerabilities can only be
                exploited by currently logged in users or by direct access to
                the console. Although no attacks using these methods have been
                confirmed as of the date of this bulletin, attacks using these
                vulnerabilities are inevitable. CIAC recommends that all
                patches be installed. 
_____________________________________________________________________________

	  Critical Information about the Help System vulnerabilities

CIAC has received information from Silicon Graphics, Inc. (SGI) concerning
vulnerabilities in the IRIX 5.x operating system that allow root access to
unauthorized users.

The vulnerabilities exist within the Help subsystem.  They have been referred
to on the Internet by various names including clogin, printer manager, and SGI
Help.  When exploited, a currently logged in user can create an active root
shell, or a person with physical access to the console can get an active root
shell without logging in.  

SGI has issued patch65 to fix these vulnerabilities.  This problem will be
corrected in a future release of IRIX.  The patch will only fix the
vulnerabilities in IRIX 5.2; no patch is scheduled for IRIX 5.1.  SGI
recommends that all IRIX 5.1 users upgrade to IRIX 5.2.  A workaround solution
exists and is effective on all versions of IRIX 5.x.  CIAC and SGI recommend
that all IRIX 5.2 users implement the workaround immediately until the IRIX
5.2 patch is obtained.


INSTALLATION OF THE WORKAROUND

To install the workaround, perform the following command as root:

   # versions remove sgihelp.sw.eoe

This workaround will neutralize this avenue of attack; however it also renders
the Help subsystem inactive.  This will affect other installed software that
use the SGI Help subsystem.  Certain help functions from within applications
will return non-fatal error messages about the missing subsystem.


INSTALLATION OF THE PATCH  (IRIX 5.2 only)

1. Determine which patch(es) you need.

To install the patch for the help vulnerabilities, you need to use the latest
SGI inst program named patch34.  To see if you already have patch34 installed
on your system, issue the following command:

   # versions patch\*

If the appropriate SGI inst program is loaded, the output will appear as
displayed below.  Another patch, patchSG0000000, is functionally equivalent to
patch34; therefore if it is present you do not need to install patch34.

   I =\ Installed, R = Removed

      Name                        Date     Description
   I  patchSG0000034              08/10/94 Patch SG0000034
   I  patchSG0000034.eoe1_sw      08/10/94 IRIX Execution Environment Software 
   I  patchSG0000034.eoe1_sw.unix 08/10/94 IRIX Execution Environment

If neither patchSG0000034 nor patchSG0000000 is loaded, you must retrieve and
load both patch34 and patch65.  Otherwise, you need only retrieve and install
patch65.

2. Retrieve the patch(es).

The patches can be retrieved in one of two methods: CD and anonymous ftp.  
SGI has made a CD available which contains the patches. To receive this CD,
contact your nearest SGI service provider and ask for a copy of it.

The patches can be retrieved via anonymous ftp from ftp.sgi.com in the
directory ~ftp/security.  CIAC is also making these patches available from
ciac.llnl.gov in the directory pub/ciac/patches/sgi.  A third location of
these patches is first.org in the directory pub/software/sgi.  Patch34 is
quite large, users are encouraged to download the patches from the closest ftp
site.  SGI is keeping a list of alternate ftp sites in the file
ftp.sgi.com:~ftp/security/ALTERNATE.SITES. 

Checksums for the patches are provided below.

Patch           Standard      System V       MD5
                Unix          Unix           Checksum
patch34.tar.Z   11066 15627   1674 31253     2859d0debff715c5beaccd02b6bebded
patch65.tar     63059 1220    15843 2440     af8c120f86daab9df74998b31927e397

3. Uninstall the workaround if it was applied to your system.

If you have applied the workaround and then wish to install the patch, the
system needs to be returned to its initial state prior to installation of the
patch.  The original Help software can be found on the original software
distribution CD labeled as IRIX 5.2. To return the system to its initial
state, perform the following command as root IMMEDIATELY PRIOR TO INSTALLATION
OF THE PATCH:

   # inst -f /CDROM/dist/sgihelp.sw.eoe
   Inst> install sgihelp.sw.eoe
   Inst> go

4. Install the patch(es).

First install patch34, after verifying the checksum.  Uncompress and untar the
files.  Inst the patch as you would any other SGI software, using the software
installation guide for additional information.

Next, install patch65 after verifying the checksum, then performing an untar
of the files.  Inst the patch as you would any other SGI software.

_____________________________________________________________________________
CIAC wishes to thank Silicon Graphics, Inc. for the information contained in
this bulletin, and Max Hailperin of Gustavus Adolphus College for his
investigation of these vulnerabilities.
_____________________________________________________________________________

For additional information or assistance, please contact CIAC:
    Voice:   510-422-8193
    FAX:     510-423-8002
    STU-III: 510-423-2604
    E-mail:  ciac@llnl.gov

Previous CIAC Bulletins and other information are available via anonymous FTP
from ciac.llnl.gov (IP address 128.115.19.53) formerly irbis.llnl.gov.

CIAC has several self-subscribing mailing lists for electronic publications:
1.  CIAC-BULLETIN for Advisories, highest priority - time critical
    information, and Bulletins, important computer security information;
2.  CIAC-NOTES for Notes, a collection of computer security articles;
3.  SPI-ANNOUNCE for official news about Security Profile Inspector (SPI)
    software updates, new features, distribution and availability;
4.  SPI-NOTES, for discussion of problems and solutions regarding the use of
    SPI products.

CIAC's mailing lists are managed by a public domain software package called
ListProcessor, which ignores E-mail header subject lines.  To subscribe (add
yourself) to one of our mailing lists, send the following request as the
E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES, SPI-ANNOUNCE or
SPI-NOTES for "list-name" and valid information for "LastName" "FirstName"
and "PhoneNumber" when sending

E-mail to ciac-listproc@llnl.gov:
          subscribe list-name LastName, FirstName PhoneNumber
    e.g., subscribe ciac-notes O'Hara, Scarlett 404-555-1212 x36

You will receive an acknowledgment containing address, initial PIN, and
information on how to change either of them, cancel your subscription, or get
help.
_____________________________________________________________________________

PLEASE NOTE: Many users outside of the DOE and ESnet computing communities
receive CIAC bulletins.  If you are not part of these communities, please
contact your agency's response team to report incidents.  Your agency's team
will coordinate with CIAC.  The Forum of Incident Response and Security Teams
(FIRST) is a world-wide organization.  A list of FIRST member organizations
and their constituencies can be obtained by sending E-mail to
first-request@first.org with an empty subject line and a message body
containing the line: send first-contacts.

This document was prepared as an account of work sponsored by an agency of
the United States Government.  Neither the United States Government nor the
University of California nor any of their employees, makes any warranty,
expressed or implied, or assumes any legal liability or responsibility for
the accuracy, completeness, or usefulness of any information, product, or
process disclosed, or represents that its use would not infringe privately
owned rights.  Reference herein to any specific commercial products, process,
or service by trade name, trademark manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation, or favoring
by the United States Government or the University of California.  The views
and opinions of authors expressed herein do not necessarily state or reflect
those of the United States Government nor the University of California, and
shall not be used for advertising or product endorsement purposes.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH