the IRIX program /usr/lib/sa/sadc is sgid sys and writes to /tmp/sa.adrfl, even if that is a symlink.
Well known, but Jaechul Choe <poison@COSMOS.KAIST.AC.KR> posted this warning that IRIX is still vulnerable.
IRIX 5.3, 6.2
9 May 1997
te: Fri, 9 May 1997 06:33:46 +0900
From: Jaechul Choe <poison@COSMOS.KAIST.AC.KR>
Subject: Re: Irix: misc
[. . .]
And one more, as addressed in [8lgm]-Advisory-11.UNIX.sadc.07-Jan-1992
and SGI security FAQ, there is a hole in /usr/lib/sa/sadc.
That's both on IRIX 5.3 and 6.2.
The tmp file to link to target is /tmp/sa_adrfl
114mS stat(/tmp/sa.adrfl, 0x10042dd8) errno = 2 (No such file or
115mS umask(0) = 0
116mS open(/tmp/sa.adrfl, O_RDWR|O_CREAT|O_TRUNC, 0664) = 3
sadc is sgid sys in IRIX so the hole may be minor
but won't it be of help to get root in conjunction with another program?
I was surprised to find the hole still existed in IRIX 6.2 then
SGI might be indifferent enough
The master index of all exploits is available
here (Very large file)
Or you can pick your favorite operating system:
This page is part of Fyodor's exploit
For a free program to automate scanning your network for vulnerable
hosts and services, check out my network mapping tool, nmap. Or try these Insecure.Org resouces: