Executive brief
A vulnerability in the 'wrap' CGI program on SGI IRIX systems allows remote attackers to view the contents of folders on the server that should be restricted. This could lead to the exposure of sensitive system information or configuration files, potentially aiding further attacks. The issue stems from the program's failure to properly block 'dot-dot' (..) sequences used to navigate the file system.
Technical details
The 'wrap' CGI executable in SGI IRIX is vulnerable to a directory traversal attack. By supplying '..' (dot-dot) sequences in the input parameters, a remote, unauthenticated attacker can bypass intended directory restrictions to view arbitrary directory listings on the host file system. This is a classic path traversal vulnerability where the application fails to sanitize user-supplied input before using it in file system operations. Successful exploitation results in information disclosure, though the CVSS 2.0 score suggests potential impacts on integrity and availability depending on the specific environment and CGI implementation. SGI released security advisories and patches (19970501-02-PX) to address this issue.
Affected products
- SGI IRIX
Timeline
- 1997-04-19: disclosed
- 1997-05-01: patched: SGI released security advisory 19970501-02-PX