-----BEGIN PGP SIGNED MESSAGE-----
__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
SGI IRIX df, pset, and eject Buffer Overrun Vulnerabilities
March 31, 1998 17:00 GMT Number H-61b
______________________________________________________________________________
PROBLEM: Three vulnerabilities have been identified on the SGI IRIX
operating system: (1) df program, (2) pset program, and (3)
eject program.
PLATFORM: All SGI systems running the following corresponding versions
of IRIX: (1) IRIX 5.3, 6.2, and 6.3; (2) IRIX 5.3 and 6.2; and
(3) Irix 6.2. Other versions may be vulnerable.
DAMAGE: All three vulnerabilities may allow local users to gain root
privileges.
SOLUTION: Apply the suggested workarounds listed below.
______________________________________________________________________________
VULNERABILITY Exploit information involving these vulnerabilities have been
ASSESSMENT: made publicly available.
______________________________________________________________________________
[ Appended to H-61a on March 31, 1998 with additional patch information from
Silicon Graphics Inc. for (2) pset Buffer Overrun]
[ Appended to H-61 on November 20,1997 with additional patch information from
Silicon Graphics Inc. for (1) df Buffer Overrun, and (3) eject Buffer Overrun]
[ Start AUSCERT Advisories ]
1. df Buffer Overrun Vulnerability
===========================================================================
AA-97.19 AUSCERT Advisory
SGI IRIX df Buffer Overrun Vulnerability
26 May 1997
Last Revised: --
- ----------------------------------------------------------------------------
AUSCERT has received information that a vulnerability exists in df(1),
distributed under IRIX 5.3, 6.2 and 6.3. Other versions may also be
vulnerable.
This vulnerability may allow local users to gain root privileges.
Exploit information involving this vulnerability has been made publicly
available.
At this stage, AUSCERT is unaware of any official vendor patches. AUSCERT
recommends that sites apply the workaround given in Section 3 until vendor
patches are made available.
This advisory will be updated as more information becomes available.
- ----------------------------------------------------------------------------
1. Description
df(1) is a program used to display statistics about the amount of used
and free disc space on file systems.
Due to insufficient bounds checking on arguments which are supplied
by users, it is possible to overwrite the internal stack space of the
df program while it is executing. By supplying a carefully designed
argument to the df program, intruders may be able to force df to
execute arbitrary commands. As df is setuid root, this may allow
intruders to run arbitrary commands with root privileges.
Sites can determine if this program is installed by using:
% ls -l /sbin/df
df is installed by default in /sbin. Sites are encouraged to check
for the presence of this program regardless of the version of IRIX
installed.
Exploit information involving this vulnerability has been made publicly
available.
2. Impact
Local users may gain root privileges.
3. Workarounds/Solution
AUSCERT recommends that sites prevent the exploitation of this
vulnerability in df by immediately applying the workaround given in
Section 3.1.
If the df functionality is required by non-root users, AUSCERT recommends
applying the workaround given in Section 3.2.
Currently there are no vendor patches available that address this
vulnerability. AUSCERT recommends that official vendor patches be
installed when they are made available.
3.1 Remove setuid and non-root execute permissions
To prevent the exploitation of the vulnerability described in this
advisory, AUSCERT recommends that the setuid permissions be removed
from the df program immediately. As df will no longer work for non-root
users, it is recommended that the execute permissions for them also
be removed.
# ls -l /sbin/df
-r-sr-xr-x 1 root sys 23136 Nov 22 1994 /sbin/df
# chmod 500 /sbin/df
# ls -l /sbin/df
-r-x------ 1 root sys 23136 Nov 22 1994 /sbin/df
3.2 Install df wrapper
AUSCERT has developed a wrapper to help prevent programs from being
exploited using the vulnerability described in this advisory. Sites
which have a C compiler can obtain the source, compile and install
the wrapper as described in Section 3.2.1. For sites without a C
compiler, AUSCERT has made pre-compiled binaries available
(Section 3.1.2).
3.2.1 Installing the wrapper from source
The source for the wrapper, including installation instructions, can
be found at:
ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/
overflow_wrapper.c
This wrapper replaces the df program and checks the length of the
command line arguments which are passed to it. If an argument exceeds
a certain predefined value (MAXARGLEN), the wrapper exits without
executing the df command. The wrapper program can also be configured
to syslog any failed attempts to execute df with arguments exceeding
MAXARGLEN. For further instructions on using this wrapper, please
read the comments at the top of overflow_wrapper.c.
When compiling overflow_wrapper.c for use with df, AUSCERT recommends
defining MAXARGLEN to be 32.
The MD5 checksum for the current version of overflow_wrapper.c can be
retrieved from:
ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM
The CHECKSUM file has been digitally signed using the AUSCERT PGP key.
3.2.2 Installing the wrapper binaries
Pre-compiled wrapper binary is provided for sites that wish to install
the wrapper but do not have a C compiler available. AUSCERT has
compiled the wrapper on IRIX 5.3, however later versions of IRIX should
be able to use the wrapper binary without recompilation. The following
compile time options have been used to create the binaries:
REAL_PROG='"/sbin/df.real"'
MAXARGLEN=32
SYSLOG
More information on these options can be found in Section 3.1.1 and
in the overflow_wrapper.c source code.
The pre-compiled binaries for the wrapper program can be retrieved from:
ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.19-df_wrapper.tar.Z
The MD5 checksum for AA-97.19-df_wrapper.tar.Z is:
MD5 (AA-97.19-df_wrapper.tar.Z) = 9d21e6358129cccbe3768757a5361f56
AA-97.19-df_wrapper.tar.Z contains a README file with installation
instructions, as well as a pre-compiled binary.
Sites are encouraged to carefully read the installation notes in the
README file before installation.
- ----------------------------------------------------------------------------
[ Appended Silicon Graphics Advisory ]
- -----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
Silicon Graphics Inc. Security Advisory
Title: IRIX df Buffer Overrun Vulnerability
Title: AUSCERT Advisory AA-97.19 and CERT Advisory CA-97.21
Number: 19970505-02-PX
Date: November 18, 1997
______________________________________________________________________________
Silicon Graphics provides this information freely to the SGI user community
for its consideration, interpretation, implementation and use. Silicon
Graphics recommends that this information be acted upon as soon as possible.
Silicon Graphics provides the information in this Security Advisory on
an "AS-IS" basis only, and disclaims all warranties with respect thereto,
express, implied or otherwise, including, without limitation, any warranty
of merchantability or fitness for a particular purpose. In no event shall
Silicon Graphics be liable for any loss of profits, loss of business, loss
of data or for any indirect, special, exemplary, incidental or consequential
damages of any kind arising from your use of, failure to use or improper
use of any of the instructions or information in this Security Advisory.
______________________________________________________________________________
- ------------------------
- ---- Issue Specifics ---
- ------------------------
The df(1) program is used to provide information about disk space
usage on a system.
The df(1) program is setuid root and as part of normal usage accepts
user arguments to operate.
It has been determined that an appropriately crafted set of arguments
could be input to the df(1) program allowing execution of arbitrary
user commands with root privileges. This resulting buffer overflow
condition is considered a security vulnerability.
Silicon Graphics Inc. has investigated the issue and recommends the
following steps for neutralizing the exposure. It is HIGHLY RECOMMENDED
that these measures be implemented on ALL SGI systems. This issue will
be corrected in future releases of IRIX.
- ---------------
- ---- Impact ---
- ---------------
The df(1) program (/sbin/df) is installed on all IRIX systems by
default.
A local account is required in order to exploit this vulnerability.
With a local account the vulnerability can be exploited both
locally and remotely.
This vulnerability can be utilized to execute commands with root
privileges.
This security issue has been publically disclosed and discussed in
several public forums including the BUGTRAQ mailing list. Additionally,
security advisories AUSCERT AA-97.19 and CERT CA-97.21 have been
publically released on the issue.
- ---------------------------
- ---- Temporary Solution ---
- ---------------------------
Although patches are available for this issue, it is realized that
there may be situations where installing the patches immediately may
not be possible.
The steps below can be used to remove the vulnerability by removing
the permissions of the df program.
1) Become the root user on the system.
% /bin/su -
Password:
#
2) Change the permissions on the df program.
# /bin/chmod 500 /sbin/df
************
*** NOTE ***
************
Removing the setuid root permissions from the df
program will prevent non-root users and applications
from using the df program.
3) Return to previous level.
# exit
$
- -----------------
- ---- Solution ---
- -----------------
OS Version Vulnerable? Patch # Other Actions
---------- ----------- ------- -------------
IRIX 3.x unknown not avail Note 1
IRIX 4.x unknown not avail Note 1
IRIX 5.0.x yes not avail Note 1
IRIX 5.1.x yes not avail Note 1
IRIX 5.2 yes not avail Note 1
IRIX 5.3 yes 2224
IRIX 6.0.x yes not avail Note 1
IRIX 6.1 yes not avail Note 1
IRIX 6.2 yes 2177
IRIX 6.3 yes 2232
IRIX 6.4 yes 2233
NOTES
1) upgrade operating system or see "Temporary Solution" section.
Patches are available via anonymous FTP and your service/support provider.
The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1) or its
mirror, ftp.sgi.com. Security information and patches can be found
in the ~ftp/security and ~ftp/patches directories, respectfully.
##### Patch File Checksums ####
The actual patch will be a tar file containing the following files:
Filename: README.patch.2177
Algorithm #1 (sum -r): 24281 8 README.patch.2177
Algorithm #2 (sum): 27018 8 README.patch.2177
MD5 checksum: 7A3DF720DD7D6B1316E9937050233280
Filename: patchSG0002177
Algorithm #1 (sum -r): 43678 1 patchSG0002177
Algorithm #2 (sum): 29631 1 patchSG0002177
MD5 checksum: F97FBC0C9E17C9BFFE4ECC03924D8250
Filename: patchSG0002177.eoe_sw
Algorithm #1 (sum -r): 17436 115 patchSG0002177.eoe_sw
Algorithm #2 (sum): 24229 115 patchSG0002177.eoe_sw
MD5 checksum: F01742532D483B02920F2837DB992CCA
Filename: patchSG0002177.idb
Algorithm #1 (sum -r): 20506 2 patchSG0002177.idb
Algorithm #2 (sum): 59240 2 patchSG0002177.idb
MD5 checksum: E52E021C27786A8047B95E0477B3B946
Filename: README.patch.2224
Algorithm #1 (sum -r): 06375 23 README.patch.2224
Algorithm #2 (sum): 65399 23 README.patch.2224
MD5 checksum: A8965CB89FF91CCE1BEC0EA31F057F2B
Filename: patchSG0002224
Algorithm #1 (sum -r): 32725 10 patchSG0002224
Algorithm #2 (sum): 11598 10 patchSG0002224
MD5 checksum: E40BC7206484A9CC583C67F8BEDCDB1A
Filename: patchSG0002224.eoe1_sw
Algorithm #1 (sum -r): 43776 2095 patchSG0002224.eoe1_sw
Algorithm #2 (sum): 16531 2095 patchSG0002224.eoe1_sw
MD5 checksum: B538973E5982C82B7450D02CCAC3F601
Filename: patchSG0002224.eoe2_sw
Algorithm #1 (sum -r): 23026 643 patchSG0002224.eoe2_sw
Algorithm #2 (sum): 24004 643 patchSG0002224.eoe2_sw
MD5 checksum: 6FCDDD383A115B97F9A884474AEFD3BD
Filename: patchSG0002224.idb
Algorithm #1 (sum -r): 46992 18 patchSG0002224.idb
Algorithm #2 (sum): 4590 18 patchSG0002224.idb
MD5 checksum: 16F15C4EBB396F49B62361D030801058
Filename: README.patch.2232
Algorithm #1 (sum -r): 30727 12 README.patch.2232
Algorithm #2 (sum): 55743 12 README.patch.2232
MD5 checksum: DD9402D2434B1513A3B9886D70CD9243
Filename: patchSG0002232
Algorithm #1 (sum -r): 55916 3 patchSG0002232
Algorithm #2 (sum): 20486 3 patchSG0002232
MD5 checksum: FE63680542E429EA91D33AA15EB06537
Filename: patchSG0002232.eoe_man
Algorithm #1 (sum -r): 43804 36 patchSG0002232.eoe_man
Algorithm #2 (sum): 27383 36 patchSG0002232.eoe_man
MD5 checksum: 6EE21B2D5362295BDC20D5F84BA7DEC4
Filename: patchSG0002232.eoe_sw
Algorithm #1 (sum -r): 03690 421 patchSG0002232.eoe_sw
Algorithm #2 (sum): 11833 421 patchSG0002232.eoe_sw
MD5 checksum: C5AD8C10999347F8FA67871B5B98CB63
Filename: patchSG0002232.idb
Algorithm #1 (sum -r): 38374 4 patchSG0002232.idb
Algorithm #2 (sum): 4337 4 patchSG0002232.idb
MD5 checksum: 0610B31450652A09F343E2B1ED3E939A
Filename: README.patch.2233
Algorithm #1 (sum -r): 51881 11 README.patch.2233
Algorithm #2 (sum): 41695 11 README.patch.2233
MD5 checksum: 5D7F90A9AE9F2A483059E6D8D08DF317
Filename: patch2233.pgp.and.chksums
Algorithm #1 (sum -r): 00000 0 patch2233.pgp.and.chksums
Algorithm #2 (sum): 0 0 patch2233.pgp.and.chksums
MD5 checksum: D41D8CD98F00B204E9800998ECF8427E
Filename: patchSG0002233
Algorithm #1 (sum -r): 18405 3 patchSG0002233
Algorithm #2 (sum): 23610 3 patchSG0002233
MD5 checksum: 462695A8E5958C4B6A78960F001A2351
Filename: patchSG0002233.eoe_man
Algorithm #1 (sum -r): 43804 36 patchSG0002233.eoe_man
Algorithm #2 (sum): 27383 36 patchSG0002233.eoe_man
MD5 checksum: 6EE21B2D5362295BDC20D5F84BA7DEC4
Filename: patchSG0002233.eoe_sw
Algorithm #1 (sum -r): 24542 347 patchSG0002233.eoe_sw
Algorithm #2 (sum): 6782 347 patchSG0002233.eoe_sw
MD5 checksum: B5D1408146E7B71B1F5A8290ABCF5A4F
Filename: patchSG0002233.idb
Algorithm #1 (sum -r): 50085 3 patchSG0002233.idb
Algorithm #2 (sum): 41850 3 patchSG0002233.idb
MD5 checksum: B41E8A31941E47BD46682CFB4641882F
- -------------------------
- ---- Acknowledgments ---
- -------------------------
Silicon Graphics wishes to thank the worldwide Internet community and the
AUSCERT and CERT Coordination Center organizations for their assistance
in this matter.
- ------------------------------------------------------------
- ---- Silicon Graphics Inc. Security Information/Contacts ---
- ------------------------------------------------------------
If there are questions about this document, email can be sent to
cse-security-alert@sgi.com.
------oOo------
Silicon Graphics provides security information and patches for
use by the entire SGI community. This information is freely
available to any person needing the information and is available
via anonymous FTP and the Web.
The primary SGI anonymous FTP site for security information and patches
is sgigate.sgi.com (204.94.209.1). Security information and patches
are located under the directories ~ftp/security and ~ftp/patches,
respectively. The Silicon Graphics Security Headquarters Web page is
accessible at the URL http://www.sgi.com/Support/security/security.html.
For issues with the patches on the FTP sites, email can be sent to
cse-security-alert@sgi.com.
For assistance obtaining or working with security patches, please
contact your SGI support provider.
------oOo------
Silicon Graphics provides a free security mailing list service
called wiretap and encourages interested parties to self-subscribe
to receive (via email) all SGI Security Advisories when they are
released. Subscribing to the mailing list can be done via the Web
(http://www.sgi.com/Support/security/wiretap.html) or by sending email
to SGI as outlined below.
% mail wiretap-request@sgi.com
subscribe wiretap <YourEmailAddress>
end
^d
In the example above, <YourEmailAddress> is the email address that you
wish the mailing list information sent to. The word end must be on a
separate line to indicate the end of the body of the message. The
control-d (^d) is used to indicate to the mail program that you are
finished composing the mail message.
------oOo------
Silicon Graphics provides a comprehensive customer World Wide Web site.
This site is located at http://www.sgi.com/Support/security/security.html.
------oOo------
For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider. A
support contract is not required for submitting a security report.
______________________________________________________________________________
This information is provided freely to all interested parties and may
be redistributed provided that it is not altered in any way, Silicon
Graphics is appropriately credited and the document retains and
includes its valid PGP signature.
- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNHIfB7Q4cFApAP75AQG/1gP/UP5/e4H9kx1eqx+Pk3PGrhRITsVwVhaZ
V3Faarq9+Vs0U0tz1zzUH3vDOk6eMMMnoDDjU60XOxfIyNA35QEq1Z3mknz7dPD2
++irDfCmqO6JFN6aQETEv1FyEfKfHgy9Pd6LtLPtkHwmK6yRK5IHJG8rqz2pl9WM
6T2RauaqUJQ=
=XJJ6
- -----END PGP SIGNATURE-----
[ End Silicon Graphics Advisory ]
2. pset Buffer Overrun Vulnerability
===========================================================================
AA-97.20 AUSCERT Advisory
SGI IRIX pset Buffer Overrun Vulnerability
27 May 1997
Last Revised: --
- ------------------------------------------------------------------------------
AUSCERT has received information that a vulnerability exists in pset(1M),
distributed under IRIX 5.3 and 6.2. Other versions may also be
vulnerable.
This vulnerability may allow local users to gain the privileges of group
sys. These privileges may then be leveraged to gain root privileges.
Exploit information involving this vulnerability has been made publicly
available.
At this stage, AUSCERT is unaware of any official vendor patches. AUSCERT
recommends that sites apply the workaround given in Section 3 until vendor
patches are made available.
This advisory will be updated as more information becomes available.
- ------------------------------------------------------------------------------
1. Description
pset(1M) is a program used to display and modify information concerning
the use of processor sets in the current system. The pset command is
used on multi-processor systems to restrict the execution of different
classes of jobs.
Due to insufficient bounds checking on arguments which are supplied
by users, it is possible to overwrite the internal stack space of the
pset program while it is executing. By supplying a carefully designed
argument to the pset program, intruders may be able to force pset to
execute arbitrary commands. As pset is setgid sys, this may allow
intruders to run arbitrary commands with the privileges of group sys.
This may then be leveraged to gain root privileges.
Sites can determine if this program is installed by using:
% ls -l /sbin/pset
pset is installed by default in /sbin. Sites are encouraged to check
for the presence of this program regardless of the version of IRIX
installed.
Exploit information involving this vulnerability has been made publicly
available.
2. Impact
This vulnerability may allow local users to gain the privileges of group
sys. These privileges may then be leveraged to gain root privileges.
3. Workarounds/Solution
AUSCERT recommends that sites prevent the exploitation of this
vulnerability in pset by immediately applying the workaround given in
Section 3.1.
If the pset functionality is required by non-root users, AUSCERT
recommends applying the workaround given in Section 3.2.
Currently there are no vendor patches available that address this
vulnerability. AUSCERT recommends that official vendor patches be
installed when they are made available.
3.1 Remove setgid and non-root execute permissions
To prevent the exploitation of the vulnerability described in this
advisory, AUSCERT recommends that the setgid permissions be removed
from the pset program immediately. As pset will no longer work for
non-root users, it is recommended that the execute permissions for
them also be removed.
# ls -l /sbin/pset
-rwsr-sr-x 1 root sys 31704 Nov 22 1994 /sbin/pset
# chmod 500 /sbin/pset
# ls -l /sbin/pset
-r-x------ 1 root sys 31704 Nov 22 1994 /sbin/pset
3.2 Install pset wrapper
AUSCERT has developed a wrapper to help prevent programs from being
exploited using the vulnerability described in this advisory. Sites
which have a C compiler can obtain the source, compile and install
the wrapper as described in Section 3.2.1. For sites without a C
compiler, AUSCERT has made pre-compiled binaries available
(Section 3.2.2).
3.2.1 Installing the wrapper from source
The source for the wrapper, including installation instructions, can
be found at:
ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/
overflow_wrapper.c
This wrapper replaces the pset program and checks the length of the
command line arguments which are passed to it. If an argument exceeds
a certain predefined value (MAXARGLEN), the wrapper exits without
executing the pset command. The wrapper program can also be configured
to syslog any failed attempts to execute pset with arguments exceeding
MAXARGLEN. For further instructions on using this wrapper, please
read the comments at the top of overflow_wrapper.c.
When compiling overflow_wrapper.c for use with pset, AUSCERT recommends
defining MAXARGLEN to be 32.
The MD5 checksum for the current version of overflow_wrapper.c can be
retrieved from:
ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM
The CHECKSUM file has been digitally signed using the AUSCERT PGP key.
3.2.2 Installing the wrapper binaries
Pre-compiled wrapper binary is provided for sites that wish to install
the wrapper but do not have a C compiler available. AUSCERT has
compiled the wrapper on IRIX 5.3, however later versions of IRIX should
be able to use the wrapper binary without recompilation. The following
compile time options have been used to create the binaries:
REAL_PROG='"/sbin/pset.real"'
MAXARGLEN=32
SYSLOG
More information on these options can be found in Section 3.2.1 and
in the overflow_wrapper.c source code.
The pre-compiled binaries for the wrapper program can be retrieved from:
ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.20-pset_wrapper.tar.Z
The MD5 checksum for AA-97.20-pset_wrapper.tar.Z is:
MD5 (AA-97.20-pset_wrapper.tar.Z) = 875367aec70936fc5f4531b0ba8ebc03
AA-97.20-pset_wrapper.tar.Z contains a README file with installation
instructions, as well as a pre-compiled binary.
Sites are encouraged to carefully read the installation notes in the
README file before installation.
4. Additional measures
Most Unix systems ship with numerous programs which have setuid or
setgid privileges. Often the functionality supplied by these privileged
programs is not required by many sites. The large number of privileged
programs that are shipped by default are to cater for all possible
uses of the system.
AUSCERT encourages sites to examine all the setuid/setgid programs
and determine the necessity of each program. If a program does not
absolutely require the setuid/setgid privileges to operate (for example,
it is only run by the root user), the setuid/setgid privileges should
be removed. Furthermore, if a program is not required at your site,
then all execute permissions should be removed.
A sample command to find all setuid/setgid programs is (run as root):
# find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -l {} \;
It is AUSCERT's experience that many vulnerabilities are being discovered
in setuid/setgid programs which are not necessary for the correct
operation of most systems. Sites can increase their security by
removing unnecessary setuid/setgid programs.
For example, the functionality provided by the pset program is not
needed by many sites. If sites had previously disabled this program,
they would not have been susceptible to this latest vulnerability.
- ------------------------------------------------------------------------------
[ Append Silicon Graphics Advisory ]
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
Silicon Graphics Inc. Security Advisory
Title: pset Buffer Overrun Vulnerability
Title: AUSCERT AA-97.20, CERT CA-97.21
Number: 19970506-02-PX
Date: March 26, 1998
______________________________________________________________________________
Silicon Graphics provides this information freely to the SGI user community
for its consideration, interpretation, implementation and use. Silicon
Graphics recommends that this information be acted upon as soon as possible.
Silicon Graphics provides the information in this Security Advisory on
an "AS-IS" basis only, and disclaims all warranties with respect thereto,
express, implied or otherwise, including, without limitation, any warranty
of merchantability or fitness for a particular purpose. In no event shall
Silicon Graphics be liable for any loss of profits, loss of business, loss
of data or for any indirect, special, exemplary, incidental or consequential
damages of any kind arising from your use of, failure to use or improper
use of any of the instructions or information in this Security Advisory.
______________________________________________________________________________
- -----------------------
- --- Issue Specifics ---
- -----------------------
Under normal operation, the pset(1M) program is used to display and manage
proccessor set information.
Unfortunately, a buffer overrun has been discovered in the pset(1M) program
which could allow arbitrary commands to be run as the privileged
user root.
Silicon Graphics Inc. has investigated the issue and recommends the
following steps for neutralizing the exposure. It is HIGHLY RECOMMENDED
that these measures be implemented on ALL vulnerable SGI systems. This
issue will be corrected in future releases of IRIX.
- --------------
- --- Impact ---
- --------------
The pset(1M) program is installed by default on IRIX 5.x through 6.3 .
IRIX 6.4 does not have the pset(1M) program.
With a local account, the pset(1M) buffer overrun vulnerability can be
exploited locally and remotely.
The pset(1M) buffer overrun vulnerability can be utilized to execute commands
with root privileges.
The pset(1M) buffer overrun vulnerability has been publicly discussed
in Usenet newsgroups and mailing lists and also reported in AUSCERT
AA-97.20 and CERT CA-97.21.
- --------------------------
- --- Temporary Solution ---
- --------------------------
Although patches are available for this issue, it is realized that
there may be situations where installing the patches immediately may
not be possible.
The steps below can be used to remove the vulnerability by removing
the permissions of the pset(1M) program.
1) Become the root user on the system.
% /bin/su -
Password:
#
2) Change the permissions on the pset(1M) program.
# /bin/chmod 500 /sbin/pset
************
*** NOTE ***
************
Removing permissions from /sbin/pset will prevent
non-root users from using the pset(1M) program
3) Return to previous level.
# exit
%
- ----------------
- --- Solution ---
- ----------------
OS Version Vulnerable? Patch # Other Actions
---------- ----------- ------- -------------
IRIX 3.x no not avail Note 1
IRIX 4.x no not avail Note 1
IRIX 5.0.x yes not avail Note 1
IRIX 5.1.x yes not avail Note 1
IRIX 5.2 yes not avail Note 1
IRIX 5.3 yes 2176
IRIX 6.0.x yes not avail Note 1
IRIX 6.1 yes not avail Note 1
IRIX 6.2 yes 2459
IRIX 6.3 yes 2792
IRIX 6.4 no
NOTES
1) upgrade to currently supported IRIX operating system or
see "Temporary Solution" section.
Patches are available via anonymous FTP and your service/support provider.
The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1) or its
mirror, ftp.sgi.com. Security information and patches can be found
in the ~ftp/security and ~ftp/patches directories, respectfully.
##### Patch File Checksums ####
The actual patch will be a tar file containing the following files:
Filename: README.patch.2176
Algorithm #1 (sum -r): 45198 9 README.patch.2176
Algorithm #2 (sum): 63297 9 README.patch.2176
MD5 checksum: A0305D199A83509F2356204DD4D5A4CA
Filename: patchSG0002176
Algorithm #1 (sum -r): 48278 1 patchSG0002176
Algorithm #2 (sum): 29497 1 patchSG0002176
MD5 checksum: 271D2085A6666CD6B3F0B7288A802789
Filename: patchSG0002176.eoe1_sw
Algorithm #1 (sum -r): 09555 36 patchSG0002176.eoe1_sw
Algorithm #2 (sum): 47593 36 patchSG0002176.eoe1_sw
MD5 checksum: 8332B895C7CC954CD9D8D57D3C834331
Filename: patchSG0002176.idb
Algorithm #1 (sum -r): 01856 1 patchSG0002176.idb
Algorithm #2 (sum): 33647 1 patchSG0002176.idb
MD5 checksum: CB1BD24A25D09DE321FA9D2844AF4035
Filename: README.patch.2459
Algorithm #1 (sum -r): 64958 8 README.patch.2459
Algorithm #2 (sum): 46142 8 README.patch.2459
MD5 checksum: CDE4AAAD19550272112CC45C994C2816
Filename: patchSG0002459
Algorithm #1 (sum -r): 40511 2 patchSG0002459
Algorithm #2 (sum): 41842 2 patchSG0002459
MD5 checksum: C60F579FEC78F06CD4932C01F4A8EC74
Filename: patchSG0002459.eoe_sw
Algorithm #1 (sum -r): 15575 78 patchSG0002459.eoe_sw
Algorithm #2 (sum): 27593 78 patchSG0002459.eoe_sw
MD5 checksum: 18BD7723AFE4C421BF5A951F88794218
Filename: patchSG0002459.idb
Algorithm #1 (sum -r): 54991 2 patchSG0002459.idb
Algorithm #2 (sum): 47185 2 patchSG0002459.idb
MD5 checksum: 4E15A06EFDBDDAEDD37867CECA904FC5
Filename: README.patch.2792
Algorithm #1 (sum -r): 33572 8 README.patch.2792
Algorithm #2 (sum): 20950 8 README.patch.2792
MD5 checksum: 60FBC74C162FFB23E6441C2F336C0CAB
Filename: patchSG0002792
Algorithm #1 (sum -r): 64174 1 patchSG0002792
Algorithm #2 (sum): 29815 1 patchSG0002792
MD5 checksum: 2582C992777A6065E3746BD1ABE193C0
Filename: patchSG0002792.eoe_sw
Algorithm #1 (sum -r): 56738 78 patchSG0002792.eoe_sw
Algorithm #2 (sum): 46753 78 patchSG0002792.eoe_sw
MD5 checksum: 3F01ED1B48B1CA62C0ED58DA24C118AF
Filename: patchSG0002792.idb
Algorithm #1 (sum -r): 07275 2 patchSG0002792.idb
Algorithm #2 (sum): 46019 2 patchSG0002792.idb
MD5 checksum: 9CC15F8952DA8ABAE23AD077751A3FC5
- ------------------------
- --- Acknowledgments ---
- ------------------------
Silicon Graphics wishes to thank AUSCERT, CERT Coordination Center
and the Internet community for their assistance in this matter.
- -----------------------------------------------------------
- --- Silicon Graphics Inc. Security Information/Contacts ---
- -----------------------------------------------------------
If there are questions about this document, email can be sent to
cse-security-alert@sgi.com.
------oOo------
Silicon Graphics provides security information and patches for
use by the entire SGI community. This information is freely
available to any person needing the information and is available
via anonymous FTP and the Web.
The primary SGI anonymous FTP site for security information and patches
is sgigate.sgi.com (204.94.209.1). Security information and patches
are located under the directories ~ftp/security and ~ftp/patches,
respectively. The Silicon Graphics Security Headquarters Web page is
accessible at the URL http://www.sgi.com/Support/security/security.html.
For issues with the patches on the FTP sites, email can be sent to
cse-security-alert@sgi.com.
For assistance obtaining or working with security patches, please
contact your SGI support provider.
------oOo------
Silicon Graphics provides a free security mailing list service
called wiretap and encourages interested parties to self-subscribe
to receive (via email) all SGI Security Advisories when they are
released. Subscribing to the mailing list can be done via the Web
(http://www.sgi.com/Support/security/wiretap.html) or by sending email
to SGI as outlined below.
% mail wiretap-request@sgi.com
subscribe wiretap <YourEmailAddress>
end
^d
In the example above, <YourEmailAddress> is the email address that you
wish the mailing list information sent to. The word end must be on a
separate line to indicate the end of the body of the message. The
control-d (^d) is used to indicate to the mail program that you are
finished composing the mail message.
------oOo------
Silicon Graphics provides a comprehensive customer World Wide Web site.
This site is located at http://www.sgi.com/Support/security/security.html.
------oOo------
For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider. A
support contract is not required for submitting a security report.
______________________________________________________________________________
This information is provided freely to all interested parties and may
be redistributed provided that it is not altered in any way, Silicon
Graphics is appropriately credited and the document retains and
includes its valid PGP signature.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNRrLWrQ4cFApAP75AQGweQP/ezwPSdg5pVh9uDA+ktVMMo/yETYeQuh7
yYidXZ+gvHJNv6mMtgcMPu80QWOx+rZlr5m/2NGFyzSVgkqV/lr9y4I2k6nRTKQU
2sSw/fJQSNDz2P+mPudZUiViKqEJG08OW97k8fbi69zEOBBsHO5Q0A8G9WuvWSXq
rI8FH8uXcIA=
=wPoL
-----END PGP SIGNATURE-----
[ End Silicon Graphics Advisory ]
3. eject Buffer Overrun Vulnerability
===========================================================================
AA-97.21 AUSCERT Advisory
SGI IRIX eject Buffer Overrun Vulnerability
27 May 1997
Last Revised: --
- ----------------------------------------------------------------------------
AUSCERT has received information that a vulnerability exists in eject(1),
distributed under IRIX 6.2. Other versions may also be vulnerable.
This vulnerability may allow local users to gain root privileges.
Exploit information involving this vulnerability has been made publicly
available.
At this stage, AUSCERT is unaware of any official vendor patches. AUSCERT
recommends that sites apply the workaround given in Section 3 until vendor
patches are made available.
This advisory will be updated as more information becomes available.
- ----------------------------------------------------------------------------
1. Description
eject(1) is a program used to eject a removable media device, such as
floppy, CDROM, or tape. If the floppy or CDROM is mounted, eject will
first try to unmount it.
Due to insufficient bounds checking on arguments which are supplied
by users, it is possible to overwrite the internal stack space of the
eject program while it is executing. By supplying a carefully designed
argument to the eject program, intruders may be able to force eject
to execute arbitrary commands. As eject is setuid root, this may
allow intruders to run arbitrary commands with root privileges.
Sites can determine if this program is installed by using:
% ls -l /usr/sbin/eject
eject is installed by default in /usr/sbin. Sites are encouraged to
check for the presence of this program regardless of the version of
IRIX installed.
Exploit information involving this vulnerability has been made publicly
available.
2. Impact
Local users may gain root privileges.
3. Workarounds/Solution
AUSCERT recommends that sites prevent the exploitation of this
vulnerability in eject by immediately applying the workaround given
in Section 3.1.
If the eject functionality is required by non-root users, AUSCERT
recommends applying the workaround given in Section 3.2.
Currently there are no vendor patches available that address this
vulnerability. AUSCERT recommends that official vendor patches be
installed when they are made available.
3.1 Remove setuid and non-root execute permissions
To prevent the exploitation of the vulnerability described in this
advisory, AUSCERT recommends that the setuid permissions be removed
from the eject program immediately. As eject will no longer have its
full functionality for non-root users, it is recommended that the
execute permissions be also removed for these users.
# ls -l /usr/sbin/eject
-rwsr-xr-x 1 root sys 45892 Nov 28 15:09 /usr/sbin/eject
# chmod 500 /usr/sbin/eject
# ls -l /usr/sbin/eject
-r-x------ 1 root sys 45892 Nov 28 15:09 /usr/sbin/eject
3.2 Install wrapper
AUSCERT has developed a wrapper to help prevent programs from being
exploited using the vulnerability described in this advisory. Sites
which have a C compiler can obtain the source, compile and install
the wrapper as described in Section 3.2.1. For sites without a C
compiler, AUSCERT has made pre-compiled binaries available (Section
3.2.2).
3.2.1 Installing the wrapper from source
The source for the wrapper, including installation instructions, can
be found at:
ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/
overflow_wrapper.c
This wrapper replaces the eject program and checks the length of the
command line arguments which are passed to it. If an argument exceeds
a certain predefined value (MAXARGLEN), the wrapper exits without
executing the eject command. The wrapper program can also be
configured to syslog any failed attempts to execute eject with
arguments exceeding MAXARGLEN. For further instructions on using this
wrapper, please read the comments at the top of overflow_wrapper.c.
When compiling overflow_wrapper.c for use with eject, AUSCERT
recommends defining MAXARGLEN to be 32.
The MD5 checksum for the current version of overflow_wrapper.c can be
retrieved from:
ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM
The CHECKSUM file has been digitally signed using the AUSCERT PGP key.
3.2.2 Installing the wrapper binaries
Pre-compiled wrapper binary is provided for sites that wish to install
the wrapper but do not have a C compiler available. AUSCERT has
compiled the wrapper on IRIX 5.3, however later versions of IRIX should
be able to use the wrapper binary without recompilation. The following
compile time options have been used to create the binaries:
REAL_PROG='"/usr/sbin/eject.real"'
MAXARGLEN=32
SYSLOG
More information on these options can be found in Section 3.2.1 and
in the overflow_wrapper.c source code.
The pre-compiled binaries for the wrapper program can be retrieved from:
ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.21-eject_wrapper.tar.Z
The MD5 checksum for AA-97.21-eject_wrapper.tar.Z is:
MD5 (AA-97.21-eject_wrapper.tar.Z) = 276bf0f51c89e54d4c584a9e8dd9265d
AA-97.21-eject_wrapper.tar.Z contains a README file with installation
instructions, as well as a pre-compiled binary.
Sites are encouraged to carefully read the installation notes in the
README file before installation.
4. Additional measures
Most Unix systems ship with numerous programs which have setuid or
setgid privileges. Often the functionality supplied by these
privileged programs is not required by many sites. The large number
of privileged programs that are shipped by default are to cater for
all possible uses of the system.
AUSCERT encourages sites to examine all the setuid/setgid programs
and determine the necessity of each program. If a program does not
absolutely require the setuid/setgid privileges to operate (for
example, it is only run by the root user), the setuid/setgid privileges
should be removed. Furthermore, if a program is not required at your
site, then all execute permissions should be removed. A sample command
to find all setuid/setgid programs is (run as root):
# find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -l {} \;
It is AUSCERT's experience that many vulnerability are being discovered
in setuid/setgid programs which are not necessary for the correct
operation of most systems. Sites can increase their security by
removing unnecessary setuid/setgid programs.
For example, if sites had previously removed the setuid permissions
for the eject program, they would not have been susceptible to this
latest vulnerability.
- ----------------------------------------------------------------------------
[ Appended Silicon Graphics Advisory ]
- -----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
Silicon Graphics Inc. Security Advisory
Title: IRIX eject Buffer Overrun Vulnerability
Title: AUSCERT Advisory AA-97.21 and CERT Advisory CA-97.21
Number: 19970507-02-PX
Date: November 18, 1997
______________________________________________________________________________
Silicon Graphics provides this information freely to the SGI user community
for its consideration, interpretation, implementation and use. Silicon
Graphics recommends that this information be acted upon as soon as possible.
Silicon Graphics provides the information in this Security Advisory on
an "AS-IS" basis only, and disclaims all warranties with respect thereto,
express, implied or otherwise, including, without limitation, any warranty
of merchantability or fitness for a particular purpose. In no event shall
Silicon Graphics be liable for any loss of profits, loss of business, loss
of data or for any indirect, special, exemplary, incidental or consequential
damages of any kind arising from your use of, failure to use or improper
use of any of the instructions or information in this Security Advisory.
______________________________________________________________________________
- ------------------------
- ---- Issue Specifics ---
- ------------------------
The eject(1) program is used to eject removable media such as floppy,
CDROM, and tape.
The eject(1) program is setuid root and as part of normal usage accepts
user arguments to operate.
It has been determined that an appropriately crafted set of arguments
could be input to the eject(1) program allowing execution of arbitrary
user commands with root privileges. This resulting buffer overflow
condition is considered a security vulnerability.
Silicon Graphics Inc. has investigated the issue and recommends the
following steps for neutralizing the exposure. It is HIGHLY RECOMMENDED
that these measures be implemented on ALL SGI systems. This issue will
be corrected in future releases of IRIX.
- ---------------
- ---- Impact ---
- - -------------
The eject(1) program (/usr/sbin/eject) is installed on all IRIX
systems by default.
A local account is required in order to exploit this vulnerability.
With a local account the vulnerability can be exploited both
locally and remotely.
This vulnerability can be utilized to execute commands with root
privileges.
This security issue has been publically disclosed and discussed in
several public forums including the BUGTRAQ mailing list. Additionally,
security advisories AUSCERT AA-97.21 and CERT CA-97.21 have been
publically released on the issue.
- ---------------------------
- ---- Temporary Solution ---
- ---------------------------
Although patches are available for this issue, it is realized that
there may be situations where installing the patches immediately may
not be possible.
The steps below can be used to remove the vulnerability by removing
the permissions of the eject program.
1) Become the root user on the system.
% /bin/su -
Password:
#
2) Change the permissions on the eject program.
# /bin/chmod 500 /usr/sbin/eject
************
*** NOTE ***
************
Removing the setuid root permissions from the eject
program will prevent non-root users and applications
from using the eject program.
3) Return to previous level.
# exit
$
- -----------------
- ---- Solution ---
- -----------------
OS Version Vulnerable? Patch # Other Actions
---------- ----------- ------- -------------
IRIX 3.x unknown not avail Note 1
IRIX 4.x unknown not avail Note 1
IRIX 5.0.x yes not avail Note 1
IRIX 5.1.x yes not avail Note 1
IRIX 5.2 yes not avail Note 1
IRIX 5.3 yes 2228
IRIX 6.0.x yes not avail Note 1
IRIX 6.1 yes not avail Note 1
IRIX 6.2 yes 2177
IRIX 6.3 yes 2232
IRIX 6.4 yes 2233
NOTES
1) upgrade operating system or see "Temporary Solution" section.
Patches are available via anonymous FTP and your service/support provider.
The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1) or its
mirror, ftp.sgi.com. Security information and patches can be found
in the ~ftp/security and ~ftp/patches directories, respectfully.
##### Patch File Checksums ####
The actual patch will be a tar file containing the following files:
Filename: README.patch.2177
Algorithm #1 (sum -r): 24281 8 README.patch.2177
Algorithm #2 (sum): 27018 8 README.patch.2177
MD5 checksum: 7A3DF720DD7D6B1316E9937050233280
Filename: patchSG0002177
Algorithm #1 (sum -r): 43678 1 patchSG0002177
Algorithm #2 (sum): 29631 1 patchSG0002177
MD5 checksum: F97FBC0C9E17C9BFFE4ECC03924D8250
Filename: patchSG0002177.eoe_sw
Algorithm #1 (sum -r): 17436 115 patchSG0002177.eoe_sw
Algorithm #2 (sum): 24229 115 patchSG0002177.eoe_sw
MD5 checksum: F01742532D483B02920F2837DB992CCA
Filename: patchSG0002177.idb
Algorithm #1 (sum -r): 20506 2 patchSG0002177.idb
Algorithm #2 (sum): 59240 2 patchSG0002177.idb
MD5 checksum: E52E021C27786A8047B95E0477B3B946
Filename: README.patch.2228
Algorithm #1 (sum -r): 56233 7 README.patch.2228
Algorithm #2 (sum): 12603 7 README.patch.2228
MD5 checksum: 30D3A289BD8219F65094F5C6D0906D00
Filename: patchSG0002228
Algorithm #1 (sum -r): 32199 1 patchSG0002228
Algorithm #2 (sum): 26600 1 patchSG0002228
MD5 checksum: 1D2A2E79B74B0A5BDEE7775C44E766D8
Filename: patchSG0002228.eoe1_sw
Algorithm #1 (sum -r): 28849 53 patchSG0002228.eoe1_sw
Algorithm #2 (sum): 11773 53 patchSG0002228.eoe1_sw
MD5 checksum: DBFBCD02E45A9A9468EBAEB115908B1D
Filename: patchSG0002228.idb
Algorithm #1 (sum -r): 04872 1 patchSG0002228.idb
Algorithm #2 (sum): 34402 1 patchSG0002228.idb
MD5 checksum: E99CCA436F10736924B10F9D9D6A5978
Filename: README.patch.2232
Algorithm #1 (sum -r): 30727 12 README.patch.2232
Algorithm #2 (sum): 55743 12 README.patch.2232
MD5 checksum: DD9402D2434B1513A3B9886D70CD9243
Filename: patchSG0002232
Algorithm #1 (sum -r): 55916 3 patchSG0002232
Algorithm #2 (sum): 20486 3 patchSG0002232
MD5 checksum: FE63680542E429EA91D33AA15EB06537
Filename: patchSG0002232.eoe_man
Algorithm #1 (sum -r): 43804 36 patchSG0002232.eoe_man
Algorithm #2 (sum): 27383 36 patchSG0002232.eoe_man
MD5 checksum: 6EE21B2D5362295BDC20D5F84BA7DEC4
Filename: patchSG0002232.eoe_sw
Algorithm #1 (sum -r): 03690 421 patchSG0002232.eoe_sw
Algorithm #2 (sum): 11833 421 patchSG0002232.eoe_sw
MD5 checksum: C5AD8C10999347F8FA67871B5B98CB63
Filename: patchSG0002232.idb
Algorithm #1 (sum -r): 38374 4 patchSG0002232.idb
Algorithm #2 (sum): 4337 4 patchSG0002232.idb
MD5 checksum: 0610B31450652A09F343E2B1ED3E939A
Filename: README.patch.2233
Algorithm #1 (sum -r): 51881 11 README.patch.2233
Algorithm #2 (sum): 41695 11 README.patch.2233
MD5 checksum: 5D7F90A9AE9F2A483059E6D8D08DF317
Filename: patch2233.pgp.and.chksums
Algorithm #1 (sum -r): 00000 0 patch2233.pgp.and.chksums
Algorithm #2 (sum): 0 0 patch2233.pgp.and.chksums
MD5 checksum: D41D8CD98F00B204E9800998ECF8427E
Filename: patchSG0002233
Algorithm #1 (sum -r): 18405 3 patchSG0002233
Algorithm #2 (sum): 23610 3 patchSG0002233
MD5 checksum: 462695A8E5958C4B6A78960F001A2351
Filename: patchSG0002233.eoe_man
Algorithm #1 (sum -r): 43804 36 patchSG0002233.eoe_man
Algorithm #2 (sum): 27383 36 patchSG0002233.eoe_man
MD5 checksum: 6EE21B2D5362295BDC20D5F84BA7DEC4
Filename: patchSG0002233.eoe_sw
Algorithm #1 (sum -r): 24542 347 patchSG0002233.eoe_sw
Algorithm #2 (sum): 6782 347 patchSG0002233.eoe_sw
MD5 checksum: B5D1408146E7B71B1F5A8290ABCF5A4F
Filename: patchSG0002233.idb
Algorithm #1 (sum -r): 50085 3 patchSG0002233.idb
Algorithm #2 (sum): 41850 3 patchSG0002233.idb
MD5 checksum: B41E8A31941E47BD46682CFB4641882F
- -------------------------
- ---- Acknowledgments ---
- -------------------------
Silicon Graphics wishes to thank the worldwide Internet community and the
AUSCERT and CERT Coordination Center organizations for their assistance
in this matter.
- ------------------------------------------------------------
- ---- Silicon Graphics Inc. Security Information/Contacts ---
- ------------------------------------------------------------
If there are questions about this document, email can be sent to
cse-security-alert@sgi.com.
------oOo------
Silicon Graphics provides security information and patches for
use by the entire SGI community. This information is freely
available to any person needing the information and is available
via anonymous FTP and the Web.
The primary SGI anonymous FTP site for security information and patches
is sgigate.sgi.com (204.94.209.1). Security information and patches
are located under the directories ~ftp/security and ~ftp/patches,
respectively. The Silicon Graphics Security Headquarters Web page is
accessible at the URL http://www.sgi.com/Support/security/security.html.
For issues with the patches on the FTP sites, email can be sent to
cse-security-alert@sgi.com.
For assistance obtaining or working with security patches, please
contact your SGI support provider.
------oOo------
Silicon Graphics provides a free security mailing list service
called wiretap and encourages interested parties to self-subscribe
to receive (via email) all SGI Security Advisories when they are
released. Subscribing to the mailing list can be done via the Web
(http://www.sgi.com/Support/security/wiretap.html) or by sending email
to SGI as outlined below.
% mail wiretap-request@sgi.com
subscribe wiretap <YourEmailAddress>
end
^d
In the example above, <YourEmailAddress> is the email address that you
wish the mailing list information sent to. The word end must be on a
separate line to indicate the end of the body of the message. The
control-d (^d) is used to indicate to the mail program that you are
finished composing the mail message.
------oOo------
Silicon Graphics provides a comprehensive customer World Wide Web site.
This site is located at http://www.sgi.com/Support/security/security.html.
------oOo------
For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider. A
support contract is not required for submitting a security report.
______________________________________________________________________________
This information is provided freely to all interested parties and may
be redistributed provided that it is not altered in any way, Silicon
Graphics is appropriately credited and the document retains and
includes its valid PGP signature.
- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNHIgZrQ4cFApAP75AQHJrwP/XiXIri9rwgQeTAI0kisDRD8S8HMINT5A
kBh6ajmDlJgE9fZus4r+dkb2zWiTI3iLWaOvZcjswBHY0BRrJZCXgpHfi1IyhJ2P
5S77I+j+/YErCN65vFAiaKaj1Wj713dTSHxjUdoECUmfkX8IJgcMDvQbRVcptIsE
2g+MVnjdiXg=
=fuer
- -----END PGP SIGNATURE-----
[ End Silicon Graphics Advisory ]
[ End AUSCERT Advisories ]
______________________________________________________________________________
CIAC wishes to acknowledge the contributions of AUSCERT and Silicon Graphic
Inc. for the information contained in this bulletin.
______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 510-422-8193
FAX: +1 510-423-8002
STU-III: +1 510-423-2604
E-mail: ciac@llnl.gov
For emergencies and off-hour assistance, DOE, DOE contractor sites,
and the NIH may contact CIAC 24-hours a day. During off hours (5PM -
8AM PST), call the CIAC voice number 510-422-8193 and leave a message,
or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two
Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC
duty person, and the secondary PIN number, 8550074 is for the CIAC
Project Leader.
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://ciac.llnl.gov/
Anonymous FTP: ciac.llnl.gov (128.115.19.53)
Modem access: +1 (510) 423-4753 (28.8K baud)
+1 (510) 423-3331 (28.8K baud)
CIAC has several self-subscribing mailing lists for electronic
publications:
1. CIAC-BULLETIN for Advisories, highest priority - time critical
information and Bulletins, important computer security information;
2. SPI-ANNOUNCE for official news about Security Profile Inspector
(SPI) software updates, new features, distribution and
availability;
3. SPI-NOTES, for discussion of problems and solutions regarding the
use of SPI products.
Our mailing lists are managed by a public domain software package
called Majordomo, which ignores E-mail header subject lines. To
subscribe (add yourself) to one of our mailing lists, send the
following request as the E-mail message body, substituting
ciac-bulletin, spi-announce OR spi-notes for list-name:
E-mail to ciac-listproc@llnl.gov or majordomo@tholia.llnl.gov:
subscribe list-name
e.g., subscribe ciac-bulletin
You will receive an acknowledgment email immediately with a confirmation
that you will need to mail back to the addresses above, as per the
instructions in the email. This is a partial protection to make sure
you are really the one who asked to be signed up for the list in question.
If you include the word 'help' in the body of an email to the above address,
it will also send back an information file on how to subscribe/unsubscribe,
get past issues of CIAC bulletins via email, etc.
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
H-51: Vulnerability in libXt
H-52: IRIX csetup Program Vulnerability
H-53: Vulnerability in webdist.cgi
H-54: Vulnerability in xlock
H-55: IRIX netprint Program Security Vulnerability
H-56: Solaris 2.x lp temporary files creation Vulnerability
H-57: Windows NT/95 Out of Band Data Exploit
H-58: IRIX runpriv Program Vulnerability
H-59: Solaris 2.x ps Buffer Overflow Vulnerability
H-60: Vulnerability in metamail
-----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition
iQCVAwUBNHS9ArnzJzdsy3QZAQHAhgQA4X2iEpdsNDFCVH+6bRTPoVWm6Kx0LqoF
jLKSNxIeejYIJHFyccnY0LSdlmG3cZE2BKY3SXYFwz0f3JlkpUrEUJHFtS55ysry
NPJ+4GQGZ4N0IIgyzYbTEQEs3ZCwM9UzMags4WqhnpYm3moimZbuoRw/hrdqA6XP
z4bd8OwtCPQ=
=LK/L
-----END PGP SIGNATURE-----
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2025 AOH
