sgihelp in IRIX contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is due to the insecure use of the system() call function, which may allow any unauthenticated and/or authenticated user to gain access to root privileges resulting in a loss of integrity.
Classification
Location:
Local Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Public
Disclosure:
OSVDB Verified
Technical
It should be noted, that the public wrapper from Max Hailperin does not fully stop the flaw. It has been also reported that the patch from SGI only prevents unauthenticated users from exploiting this flaw.
Solution
Currently, there are no known workarounds or upgrades to correct this issue. However, SGI has released a patch to address this vulnerability.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
