Executive brief
A vulnerability in the InPerson video conferencing software on SGI IRIX systems allows local users to gain full administrative (root) control. The software incorrectly looks for a required system component using an insecure search path that can be manipulated by a user. By placing a malicious program in a specific location, an attacker can trick the system into executing it with elevated privileges.
Technical details
The 'inpview' utility in the SGI InPerson desktop video conferencing package is a setuid root binary that executes the 'ttsession' program using the system() library call. Because it does not use an absolute path for 'ttsession' and fails to sanitize the PATH environment variable before execution, a local attacker can modify their PATH to point to a malicious executable named 'ttsession'. When 'inpview' is run, it executes the attacker's code with root privileges. The vulnerability is present in IRIX versions 5.3 through 6.5.10. Recommended mitigations include stripping the setuid bit from the binary or using a wrapper to sanitize environment variables.
Affected products
- SGI InPerson IRIX 5.3 through 6.5.10
Timeline
- 1997-05-07: disclosed: Initial public disclosure on Bugtraq
- 1997-05-07: advisory: NVD publication date