Re: IRIX 5.2 Security Advisory - Mystery Solved

[little () ragnarok hks com (Jim Littlefield)]

On Aug 9,  6:10pm, Paul Walmsley wrote:
:
: Found it.

You beat me to it...but not my much.

:
: The hole is essentially caused by two oversights in the SGI Help system
: - one being X accelerators (or keyboard shortcuts), the other being
: sgihelp's use of system() to pipe printer output elsewhere.

The only time the hole can be exploited is when sgihelp is running as root.
Clogin runs as root, of course. It may be possible to do the same thing via the
"System Manager" functions, although I have not checked (yet).

-- 

Jim Littlefield  <little () hks com>      I prefer caffeine free, clear, diet Jolt.