Executive brief
A vulnerability in the SGI IRIX operating system's runtime linker could allow a local user to gain full administrative control of the system. By exploiting how the system handles certain programs with elevated permissions, an attacker can bypass security restrictions to execute arbitrary code. This could lead to a complete compromise of the server, including unauthorized access to all data and the ability to disrupt operations.
Technical details
A vulnerability exists in the runtime linker (rld) of SGI IRIX 6.x and earlier. The flaw is triggered when executing setuid or setgid binaries, where the linker fails to properly sanitize the environment or validate paths, allowing a local attacker to influence the execution flow. By manipulating the runtime environment, an attacker can force a privileged process to execute or load malicious code, resulting in a full privilege escalation to root. SGI released patches (e.g., advisory 19970504-01-PX) to address this issue in the late 1990s.
Affected products
- SGI IRIX 6.x and earlier
Timeline
- 1997-05-04: advisory: SGI released security advisory 19970504-01-PX
- 1997-05-28: disclosed: NVD published date