Executive brief
A vulnerability in the 'df' command on SGI IRIX systems could allow a local user to take full control of the computer. The 'df' tool is a standard utility used to check disk space; because it runs with elevated system privileges, a flaw in how it handles input allows an attacker to bypass security restrictions. This could result in an unauthorized user gaining 'root' or administrative access, leading to a total compromise of the system's data and operations.
Technical details
A stack-based buffer overflow exists in the 'df' utility on SGI IRIX due to insufficient bounds checking on directory or block device arguments. Because the 'df' executable is setuid root, a local attacker can provide a specially crafted, overly long argument to overwrite the stack and execute arbitrary code with administrative privileges. The vulnerability can be mitigated by removing the setuid bit from the 'df' binary, using a wrapper to truncate arguments, or applying the official patches released by SGI in 1997.
Affected products
- SGI IRIX All versions prior to November 1997 patches
Timeline
- 1997-05-24: disclosed: Initial public disclosure
- 1997-07-16: advisory: NVD publication date
- 1997-11-18: patched: SGI released security advisory and patches