-----BEGIN PGP SIGNED MESSAGE----- =============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : Rene Ritzen Index : S-96-66 Distribution : World Page : Classification: External Version: Subject : CDPlayer vuln. in SGI IRIX 5.x & 6.x Date : 26-Nov-96 =============================================================================== By courtesy of AUSCERT, the Australian CERT, we received information on a vulnerability in the SGI IRIX CDPlayer distributed with IRIX 5.x and 6.x. This information is made publicly available by AUSCERT Advisory AA-96.11, dated 22 Nov 1996. CERT-NL recommends that sites apply the workaround which is given below. Keywords: cdplayer, root permission =============================================================================== AA-96.11 AUSCERT Advisory SGI IRIX cdplayer Vulnerability 22 November 1996 Last Revised: -- - - --------------------------------------------------------------------------- AUSCERT has received information that there is a vulnerability in the "cdplayer" program distributed with IRIX 5.x and 6.x. cdplayer(1) is a Motif based control panel used for playing audio compact disks. This vulnerability may allow local users to gain root privileges. Exploit details involving this vulnerability have been widely distributed. This vulnerability can be exploited without a CD-ROM drive being attached to the machine being attacked. At this stage, AUSCERT is unaware of any official vendor patches. AUSCERT recommends that sites apply the workaround given in Section 3 until vendor patches are made available. This advisory will be updated as new information becomes available. - - --------------------------------------------------------------------------- 1. Description cdplayer(1) is a program that creates a Motif based control panel used for playing audio Compact Discs on a CD-ROM drive. There is a vulnerability in cdplayer(1) that allows directories to be created anywhere on the system. These directories are created using root privileges with permissions following the umask of the person running the program. Exploit details involving this vulnerability have been made publicly available. Sites should note that a CD-ROM drive does not need to be attached for this vulnerability to be exploited. This program may be installed under both IRIX 5.x and 6.x. By default, it is installed under /usr/bin/X11/cdplayer. To determine whether the cdplayer(1) program is installed, sites should check for its presence with the command: % ls -l /usr/bin/X11/cdplayer If this program is installed, sites should take the actions recommended in Section 3 immediately. 2. Impact Local users may be able to create arbitrary directories anywhere on the system. This may be leveraged to gain root privileges. 3. Workarounds/Solution AUSCERT recommends that sites prevent the exploitation of the vulnerability in cdplayer(1) by immediately applying the workaround given in Section 3.1. Currently there are no vendor patches available that address this vulnerability. AUSCERT recommends that official vendor patches be installed when they are made available. 3.1 Remove setuid and execute permissions Until official vendor patches are made available, sites should remove the setuid root and execute permissions from cdplayer(1). To do this, the following command should be run as root: # chmod 400 /usr/bin/X11/cdplayer # ls -l /usr/bin/X11/cdplayer -r-------- 1 root sys 127648 Jul 17 12:28 /usr/bin/X11/cdplayer Note that this will remove the ability for users to run this program. If the playing of audio compact disks is essential, sites may wish to consider using cdman(1). ============================================================================== CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: http://www.surfnet.nl/surfnet/security/cert-nl.html ftp://ftp.surfnet.nl/surfnet/net-security In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl Phone: +31 302 305 305 Fax: +31 302 305 329 Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST members on request. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.i iQCVAgUBMprg8GL2fnkJN/jpAQExWQP/dzKRt3QtiwvydefkANip5hhv9WrJbwzl 5ieSaw3r6iJJPkQx7mAfzWvtFyLn9vTy48wNNscQSwpMT7w2oOdXltt6XmJbH2gJ /ydRkhuGziC0YL5Oqv46Xdy7qoX7U/0h2LoPzDZw6zDfMMrkdPhx2lR8epamE5ij v8HuWlFi2Rc= =3mNk -----END PGP SIGNATURE-----