SGI IRIX up to 6.5.17m Temp File privileges management

Summaryinfo

A vulnerability, which was classified as problematic, was found in SGI IRIX. This affects an unknown function of the component Temp File Handler. The manipulation results in privileges management. This vulnerability is cataloged as CVE-2002-1791. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in SGI IRIX (Operating System). Affected is some unknown functionality of the component Temp File Handler. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on integrity. CVE summarizes:

SGI IRIX 6.5 through 6.5.17 creates temporary desktop files with world-writable permissions, which allows local users to overwrite or corrupt those files.

The issue has been introduced in 06/01/1998. The weakness was shared 12/31/2002 (Website). The advisory is available at patches.sgi.com. This vulnerability is traded as CVE-2002-1791 since 06/29/2005. The exploitability is told to be easy. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 1674 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (10273) and SecurityFocus (BID 5895†). The entry VDB-19430 is related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• SGI

Name

• IRIX

Version

• 6.5
• 6.5.1
• 6.5.2
• 6.5.3
• 6.5.4
• 6.5.5
• 6.5.6
• 6.5.7
• 6.5.8
• 6.5.9
• 6.5.10
• 6.5.11
• 6.5.12
• 6.5.13
• 6.5.13m
• 6.5.14
• 6.5.14m
• 6.5.15
• 6.5.15m
• 6.5.16
• 6.5.16m
• 6.5.17
• 6.5.17m

License

• commercial

Support

• end of life (old version)

Website

• Vendor: http://www.sgi.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion