Executive brief
A vulnerability in the SGI IRIX operating system allows local users to gain elevated privileges, potentially reaching root access. The issue exists in the 'day5datacopier' utility, which is part of the system's web-based documentation and management tools. By tricking the system into running a malicious program instead of a standard system tool, an attacker can take full control of the machine.
Technical details
The day5datacopier utility in SGI IRIX 6.2 is a setuid-root binary that executes external system commands (specifically 'cp') using the system() function without specifying an absolute path. Because the utility relies on the PATH environment variable to locate these executables, a local attacker can modify their PATH to point to a directory containing a malicious executable named 'cp'. When day5datacopier is invoked, it executes the attacker's malicious code with root privileges. While the component is typically protected by an .htaccess file restricting access to localhost, misconfigurations or local access can allow for exploitation. The recommended fix at the time of discovery was to uninstall the affected 'whatsnew' software packages.
Affected products
- SGI IRIX 6.2
Timeline
- 1997-05-16: disclosed: Initial disclosure on Bugtraq mailing list
- 1997-05-16: advisory: NVD publication date