Re: IRIX /usr/lib/print/netprint local root symbols exploit.

From: Atro Tossavainen (atossavaat_private)
Date: Fri Apr 27 2001 - 02:44:37 PDT

Next message: Greg KH: "Immunix OS Security update for gftp"

Previous message: Progeny Security Team: "PROGENY-SA-2001-10: Older versions of NEdit make insecure use of temp files"
In reply to: v9at_private: "IRIX /usr/lib/print/netprint local root symbols exploit."
Next in thread: v9at_private: "Re: IRIX /usr/lib/print/netprint local root symbols exploit."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> this bug takes advantage of the -n option witch
> has a bug that allows for arbitrary commands to be
> executed.
>
> exploit source code:
> http://realhalo.org/xnetprint.c

In the form you give it, it doesn't work against IRIX 6.5.10, it
complains about the symbol ListAllPrinters being missing.

Adding the symbol results in gaining root, but it does require lp first.

Of course, since many SGI systems come with the lp account enabled
without a password, that would often be a trivial prerequisite.

--
Atro Tossavainen (Mr.)               / The Institute of Biotechnology at
Systems Analyst, Techno-Amish &     / the University of Helsinki, Finland,
+358-9-19158939  UNIX Dinosaur     / employs me, but my opinions are my own.
< URL : http : / / www . iki . fi / atro . tossavainen / >

Next message: Greg KH: "Immunix OS Security update for gftp"
Previous message: Progeny Security Team: "PROGENY-SA-2001-10: Older versions of NEdit make insecure use of temp files"
In reply to: v9at_private: "IRIX /usr/lib/print/netprint local root symbols exploit."
Next in thread: v9at_private: "Re: IRIX /usr/lib/print/netprint local root symbols exploit."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 27 2001 - 17:04:10 PDT