SGI Buffer Overflow Vulnerabilities

Original issue date: July 16, 1997
Last revised: January 15, 1998
Updated vendor information for SGI.

A complete revision history is at the end of this file.

The technical content of this advisory was originally published by AUSCERT (AA-97.19, AA-97.20, AA-97.21, AA-97.22, AA-97.23, AA-97.24). We use it here with their permission.


Some SGI IRIX systems have buffer overflow vulnerabilities in the following programs:

df
pset
eject
login/scheme
ordist
xlock
These vulnerabilities may allow local users to gain root privileges. Exploit information involving these vulnerabilities has been made publicly available.

A more detailed discussion of each problem appears in Section I.

All these buffer overflow problems can be addressed by similar workarounds or by installing a wrapper developed by AUSCERT (see Section III).

We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site.


I. Description

Due to insufficient bounds checking on arguments that are supplied by users, it is possible to overwrite the internal stack space of the programs listed above while they are executing. By supplying a carefully designed argument to one of these programs, intruders may be able to force the program to execute arbitrary commands. As the programs (except pset) are setuid root, this may allow intruders to run arbitrary commands with root privileges. As pset is setgid sys, this may allow intruders to run arbitrary commands with the privileges of group sys. This may then be leveraged to gain root privileges.

A. df

df(1) is a program used to display statistics about the amount of used and free disc space on file systems.

You can determine if this program is installed by typing

% ls -l /sbin/df

df is installed by default in /sbin. We encourage you to check for the presence of this program regardless of the version of IRIX installed.

B. pset

pset(1M) is a program used to display and modify information concerning the use of processor sets in the current system. The pset command is used on multi-processor systems to restrict the execution of different classes of jobs.

You can determine if this program is installed by typing

% ls -l /sbin/pset

pset is installed by default in /sbin. We encourage you to check for the presence of this program regardless of the version of IRIX installed.

C. eject

eject(1) is a program used to eject a removable media device, such as floppy, CDROM, or tape. If the floppy or CDROM is mounted, eject will first try to unmount it.

You can determine if this program is installed by typing

% ls -l /usr/sbin/eject

eject is installed by default in /usr/sbin. We encourage you to check for the presence of this program regardless of the version of IRIX installed.

D. login/scheme

login(1) is a program used at the beginning of each terminal session that allows users to identify themselves to the session. Under current versions of IRIX, this functionality is supplied by the program /usr/lib/iaf/scheme. The login program is a symbolic link to /usr/lib/iaf/scheme.

The login program is installed in /usr/bin/login. Under default configurations, this is a symbolic link to /usr/lib/iaf/scheme.

% ls -l /usr/bin/login

lrwxr-xr-x 1 root sys 17 Nov 22 1994 /usr/bin/login -> ../lib/iaf/scheme

% ls -l /usr/lib/iaf/scheme

-rwsr-xr-x 1 root sys 65832 Nov 22 1994 /usr/lib/iaf/scheme

Although this vulnerability has been verified only under IRIX 6.2, it is believed to affect other versions of IRIX, including IRIX 5.x.

E. ordist

ordist(1c) is a program used to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode and mtime of a file if possible.

You can determine if this program is installed by typing

% ls -l /usr/bsd/ordist

ordist is installed by default in /usr/bsd. We encourage you to check for the presence of this program regardless of the version of IRIX installed.

F. xlock

xlock(1) is a program that locks the local X display until a password is entered.

You can determine if this program is installed by typing

% ls -l /usr/bin/X11/xlock

xlock is installed by default in /usr/bin/X11. We encourage you to check for the presence of this program regardless of the version of IRIX installed.

For more information about vulnerabilities in xlock, see

www.cert.org/advisories/CA-97.13.xlock.

II. Impact

A. df

Local users may gain root privileges.

B. pset

Local users may gain the privileges of group sys. These privileges may then be used to gain root privileges.

C. eject

Local users may gain root privileges.

D. login/scheme

Local users may gain root privileges.

E. ordist

Local users may gain root privileges.

F. xlock

Local users may gain root privileges.

III. Solution

There are several possible solutions for these problems. In Section A, we recommend installing vendor patches. In Section B, we discuss workarounds you can use until you install vendor patches. If the workaround is inappropriate for your site, an alternative is to install a wrapper program developed by AUSCERT. Information about the wrapper is in Section C.

A. Vendor patches

Currently there are no vendor patches available that address these vulnerabilities. The CERT/CC recommends installing official vendor patches when they are available.

B. Workaround

You should prevent the exploitation of this vulnerability by immediately applying the workaround, which is to remove the setuid and non-root execute permissions of the df, eject, login/scheme, ordist, and xlock programs and to remove the setgid and non-root execute permissions of pset.

If the functionality provided by these programs is required by non-root users, apply the wrapper discussed in Section C.

1. df

To prevent the exploitation of the vulnerability described in this advisory, you should remove setuid permissions from the df program immediately. As df will no longer work for non-root users, we recommend removing the execute permissions for them also.

# ls -l /sbin/df

-r-sr-xr-x 1 root sys 23136 Nov 22 1994 /sbin/df

# chmod 500 /sbin/df

# ls -l /sbin/df

-r-x------ 1 root sys 23136 Nov 22 1994 /sbin/df

2. pset

To prevent the exploitation of this vulnerability, we recommend that you remove the setgid permissions from the pset program immediately. As pset will no longer work for non-root users, we recommend removing the execute permissions for them also.

# ls -l /sbin/pset

-rwsr-sr-x 1 root sys 31704 Nov 22 1994 /sbin/pset

# chmod 500 /sbin/pset

# ls -l /sbin/pset

-r-x------ 1 root sys 31704 Nov 22 1994 /sbin/pset

3. eject

To prevent the exploitation of the vulnerability described in this advisory, you should remove the setuid permissions from the eject program immediately. As eject will no longer have its full functionality for non-root users, we also recommend removing the execute permissions for these users.

# ls -l /usr/sbin/eject

-rwsr-xr-x 1 root sys 45892 Nov 28 15:09 /usr/sbin/eject

# chmod 500 /usr/sbin/eject

# ls -l /usr/sbin/eject

-r-x------ 1 root sys 45892 Nov 28 15:09 /usr/sbin/eject

4. login/scheme

To prevent the exploitation of the vulnerability described in this advisory, remove the setuid permissions from the scheme program immediately.

# ls -l /usr/lib/iaf/scheme

-rwsr-xr-x 1 root sys 58324 Nov 28 1996 /usr/lib/iaf/scheme

# chmod 500 /usr/lib/iaf/scheme

# ls -l /usr/lib/iaf/scheme

-r-x------ 1 root sys 58324 Nov 28 1996 /usr/lib/iaf/scheme

5. ordist

To prevent the exploitation of the vulnerability described in this advisory, you should remove the setuid permissions from the ordist program immediately. As ordist will no longer work for non-root users, we recommend removing the execute permissions for them also.

# ls -l /usr/bsd/ordist

-rwsr-xr-x 1 root sys 70564 Nov 28 15:07 /usr/bsd/ordist

# chmod 500 /usr/bsd/ordist

# ls -l /usr/bsd/ordist

-r-x------ 1 root sys 70564 Nov 28 15:07 /usr/bsd/ordist

6. xlock

To prevent the exploitation of the vulnerability described in this advisory, you should remove the setuid permissions be from the xlock program immediately. As xlock will no longer work for non-root users, we recommend removing the execute permissions for them also.

# ls -l /usr/bin/X11/xlock

-rwsr-xr-x 1 root sys 95188 Nov 28 1996 /usr/bin/X11/xlock

# chmod 500 /usr/bin/X11/xlock

# ls -l /usr/bin/X11/xlock

-r-x------ 1 root sys 95188 Nov 28 1996 /usr/bin/X11/xlock

C. Workaround

AUSCERT has developed a wrapper to help prevent programs from being exploited using the vulnerabilities described in this advisory. Sites that have a C compiler can obtain the source, and compile and install the wrapper as described in Section 1, below. For sites without a C compiler, AUSCERT has made pre-compiled binaries available as described in Section 2.

1. Installing the wrapper from source

The source for the wrapper, including installation instructions, can be found at

ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/overflow_wrapper.c

This wrapper replaces the vulnerable programs and checks the length of the command line arguments which are passed to it. If an argument exceeds a certain predefined value (MAXARGLEN), the wrapper exits without executing the command. The wrapper program can also be configured to syslog any failed attempts to execute the command with arguments exceeding MAXARGLEN. For further instructions on using this wrapper, please read the comments at the top of overflow_wrapper.c.

When compiling overflow_wrapper.c, AUSCERT recommends defining MAXARGLEN to be 32.

The MD5 checksum for the current version of overflow_wrapper.c can be retrieved from

ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM

The CHECKSUM file has been digitally signed using the AUSCERT PGP key.

2. Installing the wrapper binaries

Pre-compiled wrapper binary is provided for sites that wish to install the wrapper but do not have a C compiler available. AUSCERT has compiled the wrapper on IRIX 5.3; however later versions of IRIX should be able to use the wrapper binary without recompilation.

The pre-compiled binaries for the wrapper program can be retrieved for each vulnerability. Sites are encouraged to carefully read the installation notes in the README file before installation.

a. df

The following compile time options have been used to create the binaries:

REAL_PROG='"/sbin/df.real"'
MAXARGLEN=32
SYSLOG

More information on these options can be found in the overflow_wrapper.c source code.

You can get the pre-compiled binaries for the wrapper program from

ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.19-df_wrapper.tar.Z

MD5 (AA-97.19-df_wrapper.tar.Z) = 9d21e6358129cccbe3768757a5361f56

AA-97.19-df_wrapper.tar.Z contains a README file with installation instructions, as well as a pre-compiled binary.

b. pset

The following compile time options have been used to create the binaries:

REAL_PROG='"/sbin/pset.real"'
MAXARGLEN=32
SYSLOG

More information on these options can be found in the overflow_wrapper.c source code.

You can get pre-compiled binaries for the wrapper program from

ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.20-pset_wrapper.tar.Z

MD5 (AA-97.20-pset_wrapper.tar.Z) = 875367aec70936fc5f4531b0ba8ebc03

AA-97.20-pset_wrapper.tar.Z contains a README file with installation instructions, as well as a pre-compiled binary.

c. eject

The following compile time options have been used to create the binaries:

REAL_PROG='"/usr/sbin/eject.real"'
MAXARGLEN=32
SYSLOG

More information on these options can be found in the overflow_wrapper.c source code.

The pre-compiled binaries for the wrapper program can be retrieved from

ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.21-eject_wrapper.tar.Z

MD5 (AA-97.21-eject_wrapper.tar.Z) = 276bf0f51c89e54d4c584a9e8dd9265d

AA-97.21-eject_wrapper.tar.Z contains a README file with installation instructions, as well as a pre-compiled binary.

d. login/scheme

The following compile time options have been used to create the binaries:

REAL_PROG='"/usr/lib/iaf/scheme.real"'
MAXARGLEN=32
SYSLOG

More information on these options can be found in the overflow_wrapper.c source code.

The pre-compiled binaries for the wrapper program can be retrieved from

ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.22-scheme_wrapper.tar.Z

MD5 (AA-97.22-scheme_wrapper.tar.Z) = dc302aa275a4009d1545180bfce8ebf4

AA-97.22-scheme_wrapper.tar.Z contains a README file with installation instructions, as well as a pre-compiled binary.

e. ordist

The following compile time options have been used to create the binaries:

REAL_PROG='"/usr/bsd/ordist.real"'
MAXARGLEN=32
SYSLOG

More information on these options can be found in the overflow_wrapper.c source code.

The pre-compiled binaries for the wrapper program can be retrieved from

ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.23-ordist_wrapper.tar.Z

MD5 (AA-97.23-ordist_wrapper.tar.Z) = 0eed9d9a52658181a1ce9b4ce2ed7fd2

AA-97.23-ordist_wrapper.tar.Z contains a README file with installation instructions, as well as a pre-compiled binary.

f. xlock

The following compile time options have been used to create the binaries:

REAL_PROG='"/usr/bin/X11/xlock.real"'
MAXARGLEN=32
SYSLOG

More information on these options can be found in the overflow_wrapper.c source code.

The pre-compiled binaries for the wrapper program can be retrieved from

ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.24-xlock_wrapper.tar.Z

MD5 (AA-97.24-xlock_wrapper.tar.Z) = fe12913cd0f7bb78193488dd58cc2f4f

AA-97.24-xlock_wrapper.tar.Z contains a README file with installation instructions, as well as a pre-compiled binary.


The CERT Coordination Center staff thanks AUSCERT for permission to republish the information in six AUSCERT advisories:

AA-97.19.IRIX.df.buffer.overflow.vul
AA-97.20.IRIX.pset.buffer.overflow.vul
AA-97.21.IRIX.eject.buffer.overflow.vul
AA-97.22.IRIX.login.scheme.buffer.overflow.vul
AA-97.23-IRIX.ordist.buffer.overflow.vul
AA-97.24.IRIX.xlock.buffer.overflow.vul

AUSCERT originally thanked Ian Farquhar and the Prentice Center, University of Queensland for their assistance in the production of AA-97.22.


UPDATES

January 15, 1998

Silicon Graphics Inc. has issued Security Advisory, "IRIX df Buffer Overrun Vulnerability," 19970505-02-PX, November 18, 1997.

This SGI addresses the vulnerabilities discussed in the following documents:

AUSCERT Advisory AA-97.19 and CERT Advisory CA-97.21

September 19, 1997

Silicon Graphics Inc. has issued Security Advisory, "IRIX LOCKOUT and login/scheme Buffer Overrun" 19970508-02-PX, September 15, 1997.

This SGI advisory addresses the vulnerabilities discussed in the following documents:

AUSCERT AA-97.12 and CERT CA-97.
AUSCERT AA-97.22 and CERT CA-97.21

Patches for these vulnerabilities are available via anonymous FTP and your service/support provider.

The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1) or its mirror, ftp.sgi.com. Security information and patches can be found in the ~ftp/security and ~ftp/patches directories, respectfully.

For subscribing to the wiretap mailing list and other SGI security related information, please refer to the Silicon Graphics Security Headquarters website located at

http://www.sgi.com/Support/Secur/security.html

Copyright 1997 Carnegie Mellon University.


Revision History
Jan. 15, 1998  Updated vendor information for SGI.
Sept. 30, 1997 Updated copyright statemen
Sept. 19, 1997 Updates Section. Added updated vendor information
               for Silicon Graphics, Inc.
Aug. 11, 1997  Updates Section. Added updated vendor
               information for Silicon Graphics, Inc.
July 28, 1997  Section III.C.1 - Clarified information about wrapper.