PT-1996-1068 · Sgi · Sgi System Tour Package

Published 1996-10-30 · Updated 2016-10-18 · CVE-1999-1384

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SGI system tour package (systour) versions 5.x through 6.3

Description The issue allows local users to gain root privileges via a Trojan horse .exitops program. This program is called by the inst command, which is executed by the RemoveSystemTour program.

Recommendations For SGI system tour package (systour) versions 5.x through 6.3, consider removing or restricting access to the .exitops program to prevent exploitation until a fix is available.

Exploit

Fix

Related Identifiers

CVE-1999-1384

Affected Products

Sgi System Tour Package

References · 7

• 🔥 https://exploit-db.com/exploits/19356 · Exploit
• 🔥 http://securityfocus.com/bid/470 · Exploit
• ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-96.08.SGI.systour.vul · Patch
• https://nvd.nist.gov/vuln/detail/CVE-1999-1384 · Security Note
• ftp://patches.sgi.com/support/free/security/advisories/19961101-01-I · Vendor Advisory
• http://iss.net/security_center/static/7456.php · Note
• http://marc.info/?l=bugtraq&m=87602167420095&w=2 · Note