Title: Multiple Vendor routed traceon Vulnerability
Severity: HIGH
Description:
routed is a daemon used to dynamically update network routing tables. Certain operating systems (including IRIX 3.x up to 6.4 inclusive, Caldera OpenLinux 1.0 and 1.1) contain a routed version which allows an attacker to append certain logging data to arbitrary files on the host machine with root privileges.
routed communicates with other network components via the Routing Information Protocol (RIPv1 - RFC1058, RIPv2 - RFC1723). This protocol implements certain commands which can be sent via UDP packets to the routed service, normally residing on UDP port 520. One of these commands (listed as obsolete in RFC1058) is "traceon" which turns on certain debugging features. When this command is passed in conjunction with a "trace file" name, via RIP to a vulnerable version of routed, certain trace / debugging information is appended to this file, regardless of ownership and properties. The file specified for logging this function could therefore include /dev files, and various other important system files, and could result in denial of service or data loss when used by an attacker. An attacker would likely have to spoof the source address in order to exploit this vulnerability.
Affected Products:
- Caldera OpenLinux 1.0.0
- Caldera OpenLinux 1.1.0
- Caldera OpenLinux Base 1.1.0
- Caldera OpenLinux Lite 1.1.0
- Caldera OpenLinux Standard 1.1.0
- SGI IRIX 3.2.0
- SGI IRIX 3.3.0
- SGI IRIX 3.3.1
- SGI IRIX 3.3.2
- SGI IRIX 3.3.3
- SGI IRIX 4.0.0
- SGI IRIX 4.0.1
- SGI IRIX 4.0.1 T
- SGI IRIX 4.0.2
- SGI IRIX 4.0.3
- SGI IRIX 4.0.4
- SGI IRIX 4.0.4 B
- SGI IRIX 4.0.4 T
- SGI IRIX 4.0.5
- SGI IRIX 4.0.5 (IOP)
- SGI IRIX 4.0.5 A
- SGI IRIX 4.0.5 D
- SGI IRIX 4.0.5 E
- SGI IRIX 4.0.5 F
- SGI IRIX 4.0.5 G
- SGI IRIX 4.0.5 H
- SGI IRIX 4.0.5 IPR
- SGI IRIX 5.0.0
- SGI IRIX 5.0.1
- SGI IRIX 5.1.0
- SGI IRIX 5.1.1
- SGI IRIX 5.2.0
- SGI IRIX 5.3.0
- SGI IRIX 5.3.0 XFS
- SGI IRIX 6.0.0
- SGI IRIX 6.0.1
- SGI IRIX 6.0.1 XFS
- SGI IRIX 6.1.0
- SGI IRIX 6.2.0
- SGI IRIX 6.3.0
- SGI IRIX 6.4.0
References:
- Rootshell.com: riptrace
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
