Executive brief
A vulnerability in the NetWare Client for SGI IRIX systems allows local users to gain full administrative (root) control of the machine. The issue exists in two utility programs that are installed with administrative privileges by default. An attacker with basic access to the system can exploit these utilities to bypass security restrictions and take over the entire operating system.
Technical details
The ipxchk and ipxlink binaries in NetWare Client 1.0 on IRIX 6.3 and 6.4 are installed setuid root but fail to properly sanitize the execution environment. Specifically, they are vulnerable to an Internal Field Separator (IFS) environmental variable attack. Because these binaries call other system programs using the system() function or similar methods without resetting the environment or hardcoding paths, a local attacker can modify the IFS variable to redirect execution to a malicious program. This results in arbitrary code execution with root privileges. The vulnerability was addressed in later patches by removing the setuid bit from the affected binaries.
Affected products
- Novell NetWare Client 1.0
- SGI IRIX 6.3, 6.4
Timeline
- 1997-06: disclosed: Initial report to SGI by researcher
- 1998-04-08: advisory: Public disclosure via Bugtraq and NVD publication
- 1998-05-01: patched: SGI released patch SG0002869 addressing the issue