From: olson@anchor.esd.sgi.com (Dave Olson)
Newsgroups: comp.sys.sgi
Subject: Announcement of, and patch for, a security problem
Keywords: security, lp
Date: 8 Apr 92 01:23:10 GMT
Article-I.D.: zuni.j925v5o
Organization: Silicon Graphics, Inc.  Mountain View, CA


Attached please find a patch for a security problem found in all
versions of IRIX.  This vulnerability is *not* present in any
version of the Trusted IRIX/B product.

The problem was found (by SGI employees) by inspection
of the lp spooling system in response to recent postings on
comp.sys.sgi.  Note that this is not inherently a problem in
having an open lp account (no password), but rather a
configuration problem on the part of Silicon Graphics.  I have
heard (shortly after we found it ourselves) from only one
customer who has independently found this problem, so presumably
it isn't widely known yet.  Other Unix versions derived from early
S5R3 releases may (or may not) have similar problems.

No files need to be replaced, just modes changed to remove
set[gu]id bits, and writability of some files.  The commands to
do so are part of the attachment below.

The body of the attachment below has also been submitted to CERT
(Computer Emergency Response Team) for publication by them; it
may be published in an altered form.

To those who have been discussing security problems on
comp.sys.sgi, I (personally, not speaking for SGI) apologize for
not being able to disclose this earlier in my replies.  We have
only known about this for a matter of days, and needed to do
some testing to be sure we weren't introducing any problems by
the use of this fix.  I hope that my postings over the last few
days will be interpreted as they were written, and not as an
attempt to lull people into believing that no problems existed.


---------------------------------------------------------------------------

I.   DESCRIPTION:

     A vulnerability exists such that IRIX pre-4.0.5 systems
     with the basic system software ("eoe1.sw.unix") or the
     system manager software ("eoe2.sw.vadmin") installed can
     allow unauthorized access to the superuser account, by
     exploiting a configuration error in standard system
     utilities. Due to the ease of exploiting this vulnerability
     and the simplicity of the corrective action, the CERT/CC
     urges all sites to install the patch given below.

II.  IMPACT:

     Anyone who can login as (or su to) the user "lp" can become
     root on any pre-IRIX 4.0.5 system. As Irix is normally
     distributed, this includes any ordinary user

III. SOLUTION:

     As "root", execute the following commands:

	cd /usr/lib
	chmod a-s,go-w lpshut lpmove accept reject lpadmin
	chmod go-ws lpsched vadmin/serial_ports vadmin/users vadmin/disks
	cd /usr/bin
	chmod a-s,go-w disable enable
	chmod go-ws cancel lp lpstat

     If the eoe2.sw.vadmin software is not installed, you may
     get messages like:
       "chmod: WARNING: can't access vadmin/serial_ports"
     These can be ignored if they occur.

     If system software should ever be reloaded from pre-4.0.5
     media or from a backup tape created before the patch was
     applied, repeat the above procedure immediately after the
     software has been reloaded, before enabling logins by
     normal users.

     [ Fixed in IRIX 4.0.5 ]
----------------------------------------------------------------------
--
Let no one tell me that silence gives consent,  |   Dave Olson
because whoever is silent dissents.             |   Silicon Graphics, Inc.
    Maria Isabel Barreno                        |   olson@sgi.com
Newsgroups: comp.sys.sgi