Secunia

SGI has acknowledged multiple, older vulnerabilities in IRIX. These can be exploited by malicious users to compromise a vulnerable system or escalate their privileges.

An input validation error in the html2ps print filter can be exploited by malicious users to execute arbitrary commands on a vulnerable system with user "lp" privileges.

An error in the "Safe.pm" module can result in safe compartments being unsafe when re-used.

The gzexe and znew scripts in gzip create temporary files insecurely, which can be exploited to overwrite arbitrary files via symlink attacks.

Boundary errors in "gr_osview" and "libdesktopicon.so" can be exploited by malicious, local users to cause a buffer overflow and thereby potentially gain escalated privileges.

The vulnerabilities affect all versions prior to 6.5.23.

Solution
Update to version 6.5.23 or apply patch 5473 for versions 6.5.18 through 6.5.20 or apply patch 5474 for versions 6.5.21 through 6.5.22.

Provided and/or discovered by
Discovery of the "libdesktopicon.so" and "gr_osview" issues is credited to Last Stage of Delirium.

Changelog
Further details available in Customer Area

Original Advisory
ftp://patches.sgi.com/support/free/security/advisories/20040104-02-P.asc

Deep Links
Links available in Customer Area