Signature Detail

TELNET SGI Overflow

This signature detects attempts to exploit a known vulnerability in the TELNET daemon that ships with Silicon Graphics IRIX. When the TELNET daemon receives an IAB-SB-TELOPT_ENVIRON request to set a _RLD environment variable, it logs the attempt using syslog(). Normally, the environment variable name and value are logged, but the call to syslog uses the user-supplied variables in the format string. Attackers can maliciously craft environment variables to create a syslog format string that overwrites values on the stack and allows root access.

Extended Description

A vulnerability exists in the telnet daemon shipped with Irix versions 6.2 through 6.5.8, and in patched versions of the telnet daemon in Irix 5.2 through 6.1, from Silicon Graphics (SGI). The telnetd will blindly use data passed by the user in such a way as to make it possible for a remote attacker to execute arbitrary commands with the privileges of the daemon. In the case of the telnet daemon, this is root privileges. The telnet daemon, upon receiving a request via IAB-SB-TELOPT_ENVIRON request to set one of the _RLD environment variables, will log this attempt via syslog(). The data normally logged is the environment variable name, and the value of the environment variable. The call to syslog, however, uses the supplied variables as part of the format string. By carefully constructing the contents of these variables, it is possible to overwrite values on the stack such that supplied code may be executed as the root user. This vulnerability does not exist in unpatched versions of Irix 5.2 through 6.1. It was introduced in these versions via patches designed to address the vulnerability outlined in CERT advisory CA-95:14. This was addressed in the 1010 and 1020 series of patches. If these patches are not installed, the system is not vulnerable to this specific attack.

Affected Products

• SGI IRIX 5.2.0
• SGI IRIX 5.3.0
• SGI IRIX 5.3.0 XFS
• SGI IRIX 6.0.0
• SGI IRIX 6.0.1
• SGI IRIX 6.0.1 XFS
• SGI IRIX 6.1.0
• SGI IRIX 6.2.0
• SGI IRIX 6.3.0
• SGI IRIX 6.4.0
• SGI IRIX 6.5.0
• SGI IRIX 6.5.1
• SGI IRIX 6.5.2 m
• SGI IRIX 6.5.3
• SGI IRIX 6.5.3 f
• SGI IRIX 6.5.3 m
• SGI IRIX 6.5.4
• SGI IRIX 6.5.6
• SGI IRIX 6.5.7
• SGI IRIX 6.5.8

References

• BugTraq: 1572
• CVE: CVE-2000-0733
• URL: http://dcs.nac.uci.edu/support/sysadmin/security/archive/msg00263.html