Executive brief
A vulnerability in the HP-UX sysdiag utility allows local users to gain full administrative (root) control over the system. The utility, which is used for system diagnostics, incorrectly handles the creation of log files, allowing a standard user to trick the system into creating or modifying sensitive system files. An attacker can use this to bypass security restrictions and take over the entire operating system.
Technical details
The sysdiag utility in HP-UX (specifically versions 9.04 and 9.05) is a set-uid root program that contains a symlink vulnerability in its log file creation routine. A local attacker can create a symbolic link from a temporary file location to a non-existent sensitive system file (such as /.rhosts). By using the 'outfile' command within sysdiag to point to the symlink, the utility follows the link and creates the target file with root ownership. The attacker can then input specific strings into the sysdiag prompt that are logged into the target file, allowing for the injection of unauthorized configuration data (e.g., '+ +' in .rhosts) to achieve full privilege escalation. The vulnerability is mitigated by removing the set-uid bit from the affected diagnostic binaries.
Affected products
- HP HP-UX 9.04, 9.05
Timeline
- 1996-09-21: disclosed: Initial discovery and post to Bugtraq mailing list
- 1996-09-21: advisory: NVD Published Date