COMMAND

    at

SYSTEMS AFFECTED

    NetBSD 1.3.2 and earlier, IRIX 6.2, 6.4, 6.5, 6.5.1

PROBLEM

    Due to a bug  in the at(1) program,  any local user can  queue any
    file on the system for execution by /bin/sh, readable by root.  As
    at(1) returns errors  to the submitter,  it is possibly  that they
    may obtain parts  of the file.   The at(1) sources  use seteuid(2)
    to user ID swap between the user and root.  at(1) incorrectly  was
    setting it's cached real and effective user ID to 0 before opening
    a filename passed via the  -f flag, allowing any file  readable by
    root to be read as commands to be executed.  For example, if at(1)
    was called like this:

        % at -f /etc/master.passwd now + 1 minute

    portions of /etc/master.passwd may be mailed back to the user.  In
    this example, the security of the passwords in  /etc/master.passwd
    was compromised.

    J.A. Gutierrez tried same on IRIX 6.2 and it seems it works too:

        $ at -f /etc/shadow now + 1 minute
        -> shadow is mailed to user:

    'at' is:

        f 23947    91 patchSG0002866.eoe_sw.unix m usr/bin/at

SOLUTION

    The patch listed below changes at(1) to not change the cached real
    and effective user  ID values, but  instead, switching to  root as
    necessary.   By  removing  the  `REDUCE_PRIV'  call,  and  calling
    `PRIV_START' and `PRIV_END'  around the final  fchmod(2), security
    is  obtained.   If  the  patch  can  not be applied, the following
    command should be run as root, to remove the set-user-ID flag from
    the at(1) binary:

        # chmod u-s /usr/bin/at

    Note that  this will  disable at(1)  for normal  users.  The patch
    has been made available for  NetBSD 1.3, 1.3.1 and 1.3.2,  and can
    be found on the NetBSD FTP server:

        ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/19980626-at

    Patches for IRIX:

        OS Version   Patch #
        ----------   -------
        IRIX 6.2      3182
        IRIX 6.4      3184
        IRIX 6.5      3286
        IRIX 6.5.1    3286

    If you have not received an  IRIX 6.5.1m CD for IRIX 6.5,  contact
    your SGI Support Provider  or download the IRIX  6.5.1 Maintenance
    Release Stream from http://support.sgi.com/