CERT^® Advisory CA-1994-13 SGI IRIX Help Vulnerability

A complete revision history is at the end of this file.

The CERT Coordination Center has received information about a vulnerability in the Silicon Graphics, Inc. IRIX operating system, versions 5.1.x and 5.2. This vulnerability enables users to gain unauthorized root access. To exploit the vulnerability, a person must log into an account on the system or have physical access to the system console.

SGI has developed a patch for the vulnerability. Because the vulnerability has been widely discussed in public forums on the Internet, we recommend that you install the patch as soon as possible. Section III below contains instructions for obtaining the patch, along with a workaround you can use until you install it.

We will update this advisory as we receive additional information. Please check advisory files regularly for updates that relate to your site.

I. Description

In public discussions, the vulnerability has been referred to by various names, including clogin, printer manager, and SGI Help.

II. Impact

III. Solutions

A. For IRIX 5.2

To install this patch successfully, you need to have the latest SGI "inst" program installed (this is available as patch00 or patch34).

SGI has provided instructions for determining if the new install program is on your system. We have placed these in an appendix at the end of this advisory.

These patches are available by anonymous FTP from ftp.sgi.com and from sgigate.sgi.com in the "/security" directory.

         Filename           patch65.tar
         Standard Unix Sum  63059 1220
         System V Sum       15843 
         MD5                af8c120f86daab9df74998b31927e397


         Filename           patch34.tar.Z

         Standard Unix Sum  11066 15627

         System V Sum       1674 31253

         MD5                2859d0debff715c5beaccd02b6bebded

B. For IRIX 5.1.x

C. Workaround

# versions remove sgihelp.sw.eoe

At a later date, when the patch can be installed on the system, you will need to re-install the previously removed SGI Help software prior to installing patch65. This can be found on your original software distribution (CD labeled as IRIX 5.2). As root, use the command:

                # inst -f /CDROM/dist/sgihelp
                Inst> install sgihelp.sw.eoe
                Inst> go

Appendix

Patch34 is an update to patch00 which modifies the "inst" program to be able to handle patch updates. At least one of patch00 or patch34 is required to be installed before installing patch65. To determine if the new inst program is already installed on your system, the following command can be issued:

 # versions patch\*
        I = Installed, R = Removed

           Name                 Date      Description

        I  patchSG0000034       08/10/94  Patch SG0000034
        I  patchSG0000034.eoe1_sw 08/10/94 IRIX Execution Environment Software
        I  patchSG0000034.eoe1_sw.unix 08/10/94 IRIX Execution Environment

If patchSG0000000 or patchSG0000034 (as seen above) is loaded, then it is only necessary to download patch65 as described in the advisory. This is important since patch34 is rather large (16MB).

Otherwise, download both patch34 and patch65. Install patch34 first, then patch65. To install patch34, uncompress and untar "patch34.tar.Z" and follow the instructions in the "README.FIRST" file.

These patches are available by anonymous FTP from ftp.sgi.com in the "security" directory:

        # versions patch\*
        I = Installed, R = Removed

           Name                 Date      Description

        I  patchSG0000034       08/10/94  Patch SG0000034
        I  patchSG0000034.eoe1_sw 08/10/94 IRIX Execution Environment Software
        I  patchSG0000034.eoe1_sw.unix 08/10/94 IRIX Execution Environment

The CERT Coordination Center wishes to thank Silicon Graphics, Inc., for their cooperation in responding to this problem and members of the AUSCERT and CIAC response teams for their contributions to this advisory.

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

http://www.cert.org/

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.

Copyright 1994,1996 Carnegie Mellon University.

Sep. 23, 1997  Updated copyright statement
Aug. 30, 1996  Information previously in the README was inserted
               into the advisory.