From: ianh@resmel.bhp.com.au (Ian Hoyle)
Subject: Re: Security problem with lp (cross-post from comp.security.announce)
Organization: BHP Research - Melbourne Laboratories, AUSTRALIA
Date: Wed, 15 Apr 1992 08:15:29 GMT

I thought this should be cross-posted here ...

	ian

From: cert-advisory-request@CERT.SEI.CMU.EDU (CERT Advisory)
Date: 10 Apr 92 18:47:50 GMT
Newsgroups: comp.security.announce
Subject: CERT Advisory - "IRIX" lp Vulnerability

===========================================================================
CA-92:08                       CERT Advisory
                              April 10, 1992
        Silicon Graphics Computer Systems "IRIX" lp Vulnerability

---------------------------------------------------------------------------

The Computer Emergency Response Team/Coordination Center (CERT/CC) has
received information concerning a method of unauthorized root access
in the lp software in Silicon Graphics Computer Systems (SGI) IRIX
operating systems.  This vulnerability is present in all current
versions of IRIX.

Silicon Graphics Computer Systems and the CERT/CC strongly recommend
that sites take immediate action to eliminate this vulnerability from
their systems.

This vulnerability will be fixed in IRIX 4.0.5 and is NOT present in any
version of the Trusted IRIX/B product.

---------------------------------------------------------------------------

I.   Description

     When IRIX pre-4.0.5 systems are installed or updated using either
     the basic system software ("eoe1.sw.unix") or the system manager
     software ("eoe2.sw.vadmin") media, a vulnerability is introduced
     in the lp software.

II.  Impact

     Any user logged into the system can gain root access.

III. Solution

     As root, execute the following commands:

        # cd /usr/lib
        # chmod a-s,go-w lpshut lpmove accept reject lpadmin
        # chmod go-ws lpsched vadmin/serial_ports vadmin/users vadmin/disks
        # cd /usr/bin
        # chmod a-s,go-w disable enable
        # chmod go-ws cancel lp lpstat

     If the eoe2.sw.vadmin software is not installed, you may
     ignore any warning messages from chmod such as:

       "chmod: WARNING: can't access vadmin/serial_ports"

     If system software should ever be reinstalled from pre-4.0.5
     media or restored from a backup tape created before the patch was
     applied, repeat the above procedure before enabling logins by
     normal users.

---------------------------------------------------------------------------
The CERT/CC would like to thank Silicon Graphics Computer Systems for 
bringing this security vulnerability to our attention and for their quick
response to this problem.
---------------------------------------------------------------------------

If you believe that your system has been compromised, contact CERT/CC or
your representative in FIRST (Forum of Incident Response and Security Teams).

Internet E-mail: cert@cert.sei.cmu.edu
Telephone: 412-268-7090 (24-hour hotline)
           CERT/CC personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4),
           on call for emergencies during other hours.

Computer Emergency Response Team/Coordination Center (CERT/CC)
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213-3890

Past advisories, information about FIRST representatives, and other
information related to computer security are available for anonymous ftp
from cert.sei.cmu.edu (192.88.209.5).

Please note: cert.sei.cmu.edu is soon to become cert.org.
--
               :   Ian Hoyle,  Senior Research Scientist
               :   Image Analysis Group
     /\/\      :   BHP Research - Melbourne Laboratories
    / / /\     :   245 Wellington Rd, Mulgrave, 3170, AUSTRALIA
   / / /  \    :   Phone    +61-3-560-7066
  / / / /\ \   :   E-mail   ianh@resmel.bhp.com.au
  \ \/ / / /   :   
   \  / / /    :  "Now I've got the bead on you with MY disintegrating gun.
    \/\/\/     :   And when it disintegrates, it disintegrates. (pulls trigger)
               :   Well, what you do know, it disintegrated."
               :        -- Duck Dodgers in the 24th and a half century