Executive brief
The serial_ports administrative tool in SGI IRIX operating systems contains a security flaw in how it locates system commands. A local user can trick the system into running a malicious program instead of the intended system utility. This allows a standard user to gain full administrative (root) control over the workstation or server.
Technical details
The serial_ports administrative utility in SGI IRIX 4.x and 5.x is vulnerable to a privilege escalation attack due to insecure handling of the PATH environment variable. When executed, the program attempts to call the 'ls' command without using an absolute path. A local attacker can modify their PATH variable to point to a directory containing a malicious executable named 'ls'. Because serial_ports typically runs with elevated privileges, executing the attacker-controlled 'ls' binary allows for a full compromise of the root account. This is a classic untrusted search path vulnerability.
Affected products
- SGI IRIX 4.x, 5.x
Timeline
- 1994-10-02: disclosed: Initial publication date