TUCoPS :: Unix :: General :: cert0135.txt

-----BEGIN PGP SIGNED MESSAGE-----
=============================================================================
CERT(sm) Advisory CA-97.03
Original issue date: January 8, 1997
Last revised: May 8, 1997
 Updated the Solution section to include URL for SGI patch
 information.
 A complete revision history is at the end of this file.
Topic: Vulnerability in IRIX csetup
- -----------------------------------------------------------------------------
The CERT Coordination Center has received information about a vulnerability in
the csetup program under IRIX versions 5.x, 6.0, 6.0.1, 6.1, and 6.2. csetup is
not available under IRIX 6.3 and 6.4.
By exploiting this vulnerability, local users can create or overwrite
arbitrary files on the system. With this leverage, they can ultimately gain
root privileges.
Exploitation information involving this vulnerability has been made publicly
available.
We recommend applying a vendor patch when possible. In the meantime, we urge
sites to apply the workaround described in Section III.
We will update this advisory as we receive additional information.
Please check advisory files regularly for updates that relate to your site.
Note: Development of this advisory was a joint effort of the CERT Coordination
 Center and AUSCERT.
- -----------------------------------------------------------------------------
I. Description
 There is a vulnerability in the csetup program under IRIX versions
 5.x, 6.0, 6.0.1, 6.1, and 6.2. csetup is not available under IRIX 6.3
 and 6.4.
 csetup is part of the Desktop System Administration subsystem. The
 program provides a graphical interface allowing privileged users,
 as flagged in the objectserver (cpeople (1M)), or root to modify
 system and network configuration parameters. The csetup program is
 setuid root to allow those who are flagged as privileged users to
 modify system critical files.
 It is possible to configure csetup to run in DEBUG mode, creating a
 logfile in a publicly writable directory. This file is created in an
 insecure manner; and because csetup is running with root privileges at
 the time the logfile is created, it is possible for local users to
 create or overwrite arbitrary files on the system.
 Exploit information involving this vulnerability has been made
 publicly available.
II. Impact
 Anyone with access to an account on the system can create or overwrite
 arbitrary files on the system. With this leverage, they can ultimately
 gain root privileges.
III. Solution
 Patch information for this vulnerability is available
 in SGI"s Security Advisory 19970101-02-PX, available at
 http://www.sgi.com/Support/Secur/security.html/
- -----------------------------------------------------------------------------
This advisory is a collaborative effort between AUSCERT and the CERT
Coordination Center.
The CERT Coordination Center acknowledges Yuri Volobuev for reporting the
original problem, and Silicon Graphics, Inc. for their strong support in the
development of the advisory.
- -----------------------------------------------------------------------------
If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (see ftp://info.cert.org/pub/FIRST/first-contacts).
CERT/CC Contact Information
- ----------------------------
Email cert@cert.org
Phone +1 412-268-7090 (24-hour hotline)
 CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
 and are on call for emergencies during other hours.
Fax +1 412-268-6989
Postal address
 CERT Coordination Center
 Software Engineering Institute
 Carnegie Mellon University
 Pittsburgh PA 15213-3890
 USA
Using encryption
 We strongly urge you to encrypt sensitive information sent by email. We can
 support a shared DES key or PGP. Contact the CERT/CC for more information.
 Location of CERT PGP key
 ftp://info.cert.org/pub/CERT_PGP.key
Getting security information
 CERT publications and other security information are available from
 http://www.cert.org/
 ftp://info.cert.org/pub/
 CERT advisories and bulletins are also posted on the USENET newsgroup
 comp.security.announce
 To be added to our mailing list for advisories and bulletins, send your
 email address to
 cert-advisory-request@cert.org
- ---------------------------------------------------------------------------
Copyright 1997 Carnegie Mellon University
This material may be reproduced and distributed without permission provided
it is used for noncommercial purposes and the copyright statement is
included.
CERT is a service mark of Carnegie Mellon University.
- ---------------------------------------------------------------------------
This file: ftp://info.cert.org/pub/cert_advisories/CA-97.03.csetup
 http://www.cert.org
 click on "CERT Advisories"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision history
May 8, 1997 Updated the Solution section to include URL for SGI patch
 information.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBM3HQYHVP+x0t4w7BAQHsCwP9FNTbUVg7O6f9Pi02OGXifD0zbP2Pjljx
mR9qfATWl4Ti8xW5pc96rK1n68IKPS6QnlX83ruZtASqn1D/uixyfUHJ6nrzgtxK
/yCz2lVrpMy2w9By6V2lIiKkf+DlRZ/573zzDaHPUJR7ODo5d6zWFsjX3GLR2oWq
o2FUKbcyd50=
=WTxZ
-----END PGP SIGNATURE-----