-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AA-97.14 AUSCERT Advisory SGI IRIX webdist.cgi Vulnerability 7 May 1997 Last Revised: -- 27 August 1997 Changed Section 3 to include vendor patch and bulletin information. A complete revision history is at the end of this file. - --------------------------------------------------------------------------- AUSCERT has received information of a security vulnerability in the webdist.cgi cgi-bin program, part of the IRIX Mindshare Out Box package, available with IRIX 5.x and 6.x. By exploiting this vulnerability, both local and remote users may be able to execute arbitrary commands with the privileges of the httpd daemon. This may be used to compromise the http server and under certain configurations gain privileged access. Vendor patches have been released addressing this vulnerability. AUSCERT recommends that sites take the steps outlined in section 3 as soon as possible. This advisory will be updated as more information becomes available. Note: Development of this advisory was a joint effort of the CERT Coordination Center and AUSCERT. This material was also released as CERT Advisory CA-97.12. - --------------------------------------------------------------------------- 1. Description A security vulnerability has been reported in the webdist.cgi cgi-bin program available with IRIX 5.x and 6.x. webdist.cgi is part of the IRIX Mindshare Out Box software package, which allows users to install software over a network via a World Wide Web interface. webdist.cgi allows webdist(1) to be used via an HTML form interface defined in the file webdist.html, which is installed in the default document root directories for both the Netsite and Out Box servers. Due to insufficient checking of the arguments passed to webdist.cgi, it may be possible to execute arbitrary commands with the privileges of the httpd daemon. This is done via the webdist program. When installed, webdist.cgi is accessible by anyone who can connect to the httpd daemon. Because of this, the vulnerability may be exploited by remote users as well as local users. Even if a site's webserver is behind a firewall, it may still be vulnerable. Determining if your site is vulnerable -------------------------------------- All sites are encouraged to check their systems for the IRIX Mindshare Out Box software package, and in particular the Webdist Software package which is a subsystem of the Mindshare Out Box software package. To determine if this package is installed, use the command: # versions outbox.sw.webdist I = Installed, R = Removed Name Date Description I outbox 11/06/96 Outbox Environment, 1.2 I outbox.sw 11/06/96 Outbox End-User Software, 1.2 I outbox.sw.webdist 11/06/96 Web Software Distribution Tools, 1.2 2. Impact Local and remote users may be able to execute arbitrary commands on the HTTP server with the privileges of the httpd daemon. This may be used to compromise the http server and, under certain configurations, gain privileged access. 3. Workarounds/Solution Official vendor patches have been released by Silicon Graphics which address this vulnerability (Section 3.3). If the patches recommended by Silicon Graphics cannot be applied, AUSCERT recommends that sites prevent the exploitation of this vulnerability by immediately applying the workaround given in Sections 3.1 or 3.2. 3.1 Remove execute permissions Sites should immediately remove the execute permissions on the webdist.cgi program to prevent its exploitation. By default, webdist.cgi is found in /var/www/cgi-bin/, but sites should check all cgi-bin directories for this program. # ls -l /var/www/cgi-bin/webdist.cgi -rwxr-xr-x 1 root sys 4438 Nov 6 12:44 /var/www/cgi-bin/webdist.cgi # chmod 400 /var/www/cgi-bin/webdist.cgi # ls -l /var/www/cgi-bin/webdist.cgi -r-------- 1 root sys 4438 Nov 6 12:44 /var/www/cgi-bin/webdist.cgi Note that this will prevent all users from using the webdist program from the HTML form interface. 3.2 Remove outbox.sw.webdist subsystem If the Webdist software is not required, we recommend that sites remove it completely from their systems. This can be done with the command: # versions remove outbox.sw.webdist Sites can check that the package has been removed with the command: # versions outbox.sw.webdist 3.3 Install vendor patches Silicon Graphics has released patches which address the vulnerability described in this advisory. AUSCERT recommends that sites apply theses patches as soon as possible. Operating System Vulnerable? Patch # Other Actions ~~~~~~~~~~~~~~~~ ~~~~~~~~~~~ ~~~~~~~ ~~~~~~~~~~~~~ IRIX 3.x no IRIX 4.x no IRIX 5.0.x no IRIX 5.1.x no IRIX 5.2 no IRIX 5.3 yes 2315 IRIX 6.0.x yes not avail Note 1 IRIX 6.1 yes not avail Note 1 IRIX 6.2 yes 2314 IRIX 6.3 yes 2338 IRIX 6.4 yes 2338 Notes: 1) upgrade the operating system or apply the workaround given in Section 3.1 or 3.2. These patches can be retrieved from: http://www.sgi.com/Support/Secur/security.html Silicon Graphics has also released a security bulletin containing information on the above patches. The original release of this bulletin can be retrieved from: ftp://sgigate.sgi.com/security/19970501-02-PX 4. Additional Measures Sites should consider taking this opportunity to examine their entire httpd configuration. In particular, all CGI programs that are not required should be removed, and all those remaining should be examined for possible security vulnerabilities. It is also important to ensure that all child processes of httpd are running as a non-privileged user. This is often a configurable option. See the documentation for your httpd distribution for more details. Numerous resources relating to WWW security are available. The following pages may provide a useful starting point. They include links describing general WWW security, secure httpd setup, and secure CGI programming. The World Wide Web Security FAQ: http://www-genome.wi.mit.edu/WWW/faqs/www-security-faq.html NSCA's "Security Concerns on the Web" Page: http://hoohoo.ncsa.uiuc.edu/security/ The following book contains useful information including sections on secure programming techniques. _Practical Unix & Internet Security_, Simson Garfinkel and Gene Spafford, 2nd edition, O'Reilly and Associates, 1996. Please note that the CERT/CC and AUSCERT do not endorse the URLs that appear above. If you have any problems with these sites, please contact the site administrator. - ----------------------------------------------------------------------------- This advisory is a collaborative effort between AUSCERT and the CERT Coordination Center. This material was also released as CERT Advisory CA-97.12. We thank Yuri Volobuev for reporting this problem. We also thank Martin Nicholls (The University of Queensland) and Ian Farquhar for their assistance in further understanding this problem and its solution. - ----------------------------------------------------------------------------- The AUSCERT team have made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The appropriateness of this document for an organisation or individual system should be considered before application in conjunction with local policies and procedures. AUSCERT takes no responsibility for the consequences of applying the contents of this document. If you believe that your system has been compromised, contact AUSCERT or your representative in FIRST (Forum of Incident Response and Security Teams). AUSCERT is located at The University of Queensland within the Prentice Centre. AUSCERT is a full member of the Forum of Incident Response and Security Teams (FIRST). AUSCERT maintains an anonymous FTP service which is found on: ftp://ftp.auscert.org.au/pub/. This archive contains past SERT and AUSCERT Advisories, and other computer security information. AUSCERT also maintains a World Wide Web service which is found on: http://www.auscert.org.au/. Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 4477 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AUSCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for emergencies. Postal: Australian Computer Emergency Response Team Prentice Centre Brisbane Qld. 4072. AUSTRALIA ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Revision History 27 Aug, 1997 Silicon Graphics released a security bulletin addressing the vulnerability described in this advisory. Section 3 has been modified to include vendor patch information. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBNAaZvSh9+71yA2DNAQGrsAP/YOKYkqSBzoi9tbFE2Ygki6PPE9bi7CNU q8g7cL7h/BI8Um00w11OmNR+50/wUWiZ91ZWGg0OB5YEMGmLjYda7f+wjzd5psF9 CqaqnJle77DnoLJNPCHiwvZXc8nBojwfla7AmgUi+Kf8GMKNVUfb/NiMmSRD5AS6 MS5wXo0OYMI= =JQAF -----END PGP SIGNATURE-----