COMMAND

    WorlView

SYSTEMS AFFECTED

    WorlView

PROBLEM

    Following is based on a  SGI Security Advisory.  SGI  acknowledges
    the root  buffer overflow  vulnerability in  WorldView reported by
    Shadow Penguin Security Org. on the FreeWnn Mailing List:

        http://www.tomo.gr.jp/users/wnn/0008ml/msg00000.html (in Japanese)

    and also reported by Omron Software on

        http://www.omronsoft.co.jp/SP/support/pcunix/wnn/update1.html (in Japanese)

    SGI is currently working on patches.

    Omron  WorldView  is  an  optional  purchased  product used by SGI
    customers that require  foreign language support  in IRIX.   It is
    not installed  by default  on base  IRIX.   Only SGI  systems that
    have WorldView installed are vulnerable to this issue.

    The  WorldView  vulnerability  can  lead  to root access through a
    buffer  overflow  exploit.   A  workaround  is  provided  below to
    minimize exposure to the buffer overflow by changing ownership  of
    the jserver to a non-privileged user.

SOLUTION

    The steps below can be used to minimize exposure to the  WorldView
    vulnerability (translated from Japanese):

        1) Become the root user on the system.
           % /bin/su -
           Password:
           #

        2) Verify  WorldView  is  installed.  Only  systems that  have
           WorldView installed are vulnerable.
           # versions -b
           I  WorldView_base_jp    05/06/1998  WorldView Base Japanese 6.5
           I  WorldView_books_jp   05/06/1998  WorldView Books: Japanese 6.5
           I  WorldView_fonts_jp1  05/06/1998  WorldView Fonts Japanese, 6.5
           I  WorldView_japanese   05/06/1998  WorldView Japanese 6.5

        3) If  the  WorldView  is  not  currently needed, disable  the
           jserver.
           # chkconfig jserver off

        4) Add  the  following  lines  to the files /etc/password  and
           /etc/group with a text editor like vi.
             /etc/passwd: wnn:*:127:127:Wnn System Account:/usr/lib/wnn6:/bin/sh
              /etc/group: wnn:*:127

        5) Change the owner of the WNN related files.
           # chown -R wnn.sys /usr/bin/Wnn6
           # chown -R wnn.sys /usr/lib/wnn6

        6) Verify that the file ownership changes have been made.
           # ls -ls /usr/bin/Wnn6/jserver
           1136 -r-sr-xr-x    1 wnn      sys       578660

           # ls -ls /usr/lib/wnn6/serverdefs
           8 -rw-r--r--    1 wnn      sys          662

        7) Reboot the system.
           # reboot