Executive brief
A vulnerability in the xfsdump utility on SGI IRIX systems could allow a local user to gain full administrative (root) control of the system. The utility incorrectly handles log file creation in a public temporary directory, which can be manipulated to overwrite sensitive system files. This could lead to a complete compromise of the operating system and any data stored on it.
Technical details
The xfsdump utility in SGI IRIX (versions 5.3, 6.2, and 6.3) is vulnerable to a symlink attack during the creation of its log file, /usr/tmp/bck.log. Because the utility runs with elevated privileges and writes to a world-writable directory without proper checks, a local attacker can create a symbolic link from /usr/tmp/bck.log to a sensitive system file (such as /etc/passwd or a system binary). When xfsdump is executed, it follows the symlink and overwrites the target file with log data. By carefully timing this or manipulating the log content, an attacker can achieve arbitrary file write and subsequent privilege escalation to root. A common workaround involves manually creating the log file ('touching' it) to prevent an attacker from placing a symlink at that location.
Affected products
- SGI IRIX 5.3, 6.2, 6.3
Timeline
- 1997-05-07: disclosed: Initial disclosure on Bugtraq by Yuri Volobuev