IRIX df utility allows local user to gain root privileges through a buffer overflow
| df-bo (440) |  High Risk |
Description:
The IRIX df(1) utility is vulnerable to a buffer overflow. A buffer overflow could allow a local user to execute arbitrary commands with root privileges.
Platforms Affected:
- SGI, IRIX 5.0
- SGI, IRIX 5.0.1
- SGI, IRIX 5.1
- SGI, IRIX 5.1.1
- SGI, IRIX 5.2
- SGI, IRIX 5.3
- SGI, IRIX 5.3 XFS
- SGI, IRIX 6.0
- SGI, IRIX 6.0.1
- SGI, IRIX 6.1
- SGI, IRIX 6.2
- SGI, IRIX 6.3
- SGI, IRIX 6.4
Remedy:
Obtain and install the following patches from SGI:
- IRIX 5.3: 2224
- IRIX 6.2: 2177
- IRIX 6.3: 2232
- IRIX 6.4: 2233
Users of other affected IRIX versions should upgrade to a supported release and then apply one of the above patches (if necessary).
Consequences:
Gain Privileges
References:
- AusCERT Advisory AA-97.19, SGI IRIX df Buffer Overrun Vulnerability at ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-97.19.IRIX.df.buffer.overflow.vul.
- CERT Advisory CA-1997-21, SGI Buffer Overflow Vulnerabilities at http://www.cert.org/advisories/CA-1997-21.html.
- CIAC Information Bulletin H-61b, SGI IRIX df, pset, and eject Buffer Overrun Vulnerabilities at http://ciac.llnl.gov/ciac/bulletins/h-61b.shtml.
- SGI Security Advisory 19970505-01-A, IRIX df Buffer Overrun Vulnerability at ftp://patches.sgi.com/support/free/security/advisories/19970505-01-A.
- SGI Security Advisory 19970505-02-PX, IRIX df Buffer Overrun Vulnerability at ftp://patches.sgi.com/support/free/security/advisories/19970505-02-PX.
- BID-346: IRIX df Vulnerability
- CVE-1999-0025: root privileges via buffer overflow in df command on SGI IRIX systems.
- US-CERT VU#20851: SGI IRIX df buffer overflow in directory argument
Reported:
Jul 01, 1997
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net