SGI Tempo System Database Exposure

CVE-2014-7303

Type

SGI Tempo System Database Exposure

Severity

Affected products

SGI Tempo (SGI ICE-X Supercomputers)

Affected Versions

Unknown

Vendor

Silicon Graphics International Corp (SGI)

Vendor Response

Uncooperative

Authors

John Fitzpatrick MWR Labs

CVE Reference

CVE-2014-7303

Timeline

SGI have chosen not to co-operate with MWR in the co-ordinated disclosure of this and other SGI related security issues. MWR are therefore unable to provide specific version information and other details. Whilst every effort has been made to ensure the accuracy and usefulness of this advisory it is recommend that SGI are contacted directly if further information is required.


2014-02-11	Contact with SGI established
2014-02-20	Full vulnerability details provided to SGI
2014-04-14	Vulnerabilities acknowledged and response provided
2014-05-23	Update requested by MWR (not provided)
2014-07-23	Update requested by MWR (not provided)
2014-11-20	Contact with SGI re-attempted
2014-12-02	Advisory published

Description

It is possible for users of ICE-X supercomputers to gain access to backups of system configuration databases.

Impact

The impact depends on the type of information held within this database. More recent versions of Tempo store root password hashes in the database, while in earlier versions of Tempo the impact is believed to me more limited.

Cause

Insecure (world readable) file permissions are set on the database backup.

Solution

SGI have chosen not to co-operate on resolving this issue. However, a workaround is possible:

Alter the permissions on any current database dumps (this should be run/checked on all service nodes)

chmod 600 /etc/dbdump.db

Within the file /etc/opt/sgi/conf.d/80-update-mysql find the following section of code:

command = “mysqldump —user=root —pass=” + password + ” —all-databases —master-data > /etc/dbdump.db”

Alter this to the following, in order to ensure the more secure permissions persist reboots:

command = “mysqldump —user=root —pass=” + password + ” —all-databases —master-data > /etc/dbdump.db; chmod 600 /etc/dbdump.db”

SGI have chosen not to cooperate with MWR in the co-ordinated disclosure of this and other SGI related security issues. MWR are therefore unable to provide specific version information and other details surrounding this issue. Whilst every effort has been made to ensure the accuracy and usefulness of this advisory it is recommend that SGI are contacted directly if further information is required.