SGI IRIX up to 6.2 /usr/lib/netaddpr race condition

Summaryinfo

A vulnerability, which was classified as problematic, was found in SGI IRIX up to 6.2. This affects an unknown function of the file /usr/lib/netaddpr. The manipulation results in race condition. This vulnerability is known as CVE-1999-1410. Furthermore, an exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in SGI IRIX up to 6.2 (Operating System). Affected is some unknown functionality of the file /usr/lib/netaddpr. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

addnetpr in irix 5.3 and 6.2 allows local users to overwrite arbitrary files and possibly gain root privileges via a symlink attack on the printers temporary file.

The issue has been introduced in 03/01/1993. The weakness was published 05/09/1997 by Jaechul Choe with AIST as not defined posting (Bugtraq). The advisory is available at marc.theaimsgroup.com. This vulnerability is traded as CVE-1999-1410. The exploitability is told to be difficult. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known.

A public exploit has been developed in Shell File. The exploit is shared for download at securityfocus.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1530 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 6.3 or 6.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (19260) and SecurityFocus (BID 330†). Similar entry is available at VDB-13889. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• SGI

Name

• IRIX

Version

• 5.0
• 5.0.1
• 5.1
• 5.1.1
• 5.2
• 5.3
• 6.0.1
• 6.1
• 6.2

License

• commercial

Support

• end of life (old version)

Website

• Vendor: http://www.sgi.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion