Vulnerability Note VU#195371

SGI IRIX rpc.xfsmd does not filter shell metacharacters from user input before invoking popen() function

As mentioned in VU#20276:

The popen(3) call is described by the man page as follows:

                 FILE *popen(const char *command, const char *type);

                 popen() creates a pipe between the calling program and the command to be executed. The arguments to popen() are pointers to null-terminated strings. "command" consists of a shell command line.

In essence, popen provides the calling program the output of "command." One example of a command you could pass to popen is

                 cat /etc/passwd

In this case, popen would return the output of the "cat /etc/passwd" file to the calling program. You can also pass more complex shell commands to popen, such as

                 cat /etc/passwd & rm *

The ampersand character (&) puts the preceding command in the background and executes the rest of the command in the foreground. As another example, you can execute a sequence of commands by separating them with semicolons (;). For example,

                 ls ; rm * ; touch filename

This runs the commands sequentially.

Per SGI Security Advisory 20020606-02-I:

There is no effective workaround available for these problems.
SGI recommends either disabling or uninstalling the product.

To disable the product from running, perform the following steps:

  # killall /usr/etc/xfsmd
 # vi /etc/inetd.conf

  Look for a line in inetd.conf that looks like this:

    sgi_xfsmd/1 stream  rpc/tcp wait    root    ?/usr/etc/xfsmd     xfsmd

  ...and comment it out by putting a "#" at the beginning of the line:

    #sgi_xfsmd/1 stream  rpc/tcp wait    root    ?/usr/etc/xfsmd     xfsmd

  ...or simply remove the line from the file.

  # killall -HUP inetd

To remove the product from the system, perform the following command:

  # versions remove eoe.sw.xfsmserv

Systems Affected

http://www.kb.cert.org/vuls/id/521147
https://www.securecoding.cert.org/confluence/x/1IAg
https://www.securecoding.cert.org/confluence/x/-AY
ftp://patches.sgi.com/support/free/security/advisories/20020606-02-I
http://www.securityfocus.com/bid/5075
http://www.iss.net/security_center/static/9402.php
http://oss.sgi.com/projects/xfs/
http://www.sgi.com/software/xfs/

Credit

Last Stage of Delirium reported this vulnerability in several public forums.

This document was written by Jeffrey S. Havrilla.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.