Executive brief
A vulnerability in the addnetpr utility of the SGI IRIX operating system allows local users to manipulate system files. By exploiting how the system handles temporary files, an attacker can overwrite sensitive data or potentially gain full administrative (root) control over the machine. This could lead to a complete compromise of the system's integrity and confidentiality.
Technical details
The addnetpr utility, a setuid root program used for printer configuration in SGI IRIX, is vulnerable to a symlink attack. The program creates temporary files in /var/tmp (e.g., using patterns like /var/tmp/printersXXXXXX) without proper race condition protections. A local attacker can monitor for the creation of these temporary files and create a symbolic link to a sensitive system file (such as /etc/passwd). Because addnetpr runs with root privileges, it will follow the symlink and write data to the target file, allowing the attacker to modify arbitrary files or gain root access. The vulnerability affects IRIX versions 6.2 and earlier, including 5.3.
Affected products
- SGI IRIX 6.2 and earlier
Timeline
- 1996-12-03: advisory: SGI security advisory 19961203-02-PX released
- 1997-05-09: disclosed: Public disclosure on Bugtraq mailing list
- 1997-05-09: advisory: NVD published date