Executive brief
A security vulnerability exists in the Korn Shell (ksh) component of older operating systems like SGI IRIX. This component is responsible for executing commands with elevated permissions. An attacker who already has basic access to the system can exploit this flaw to gain full administrative (root) control, potentially leading to total system compromise and data theft.
Technical details
A buffer overflow vulnerability exists within the suid_exec utility of the Korn Shell (ksh), specifically on SGI IRIX 6.x and potentially other Unix-like operating systems. The flaw is located in the handling of environment variables or command-line arguments passed to the setuid-root suid_exec binary. A local, unprivileged attacker can exploit this by providing specially crafted input that overflows a memory buffer, allowing for the execution of arbitrary code with root privileges. Patches were historically released by SGI and other affected vendors to address this issue.
Affected products
- SGI IRIX 6.x and earlier
- AT&T Korn Shell (ksh)
Timeline
- 1998-04-05: advisory: SGI security advisory 19980405-01-I released
- 1998-04-08: disclosed: NVD publication date