Software: SGI Tempo (SGI ICE-X Supercomputers)
Affected Versions: Unknown
CVE Reference: CVE-2014-7303
Author: John Fitzpatrick, MWR Labs
Severity: Low Risk
Vendor: Silicon Graphics International Corp (SGI)
Vendor Response: Uncooperative
Description
It is possible for users of ICE-X supercomputers to gain access to backups of system configuration databases.
Impact
The impact depends on the type of information held within this database. More recent versions of Tempo store root password hashes in the database, while in earlier versions of Tempo the impact is believed to me more limited.
Cause
Insecure (world readable) file permissions are set on the database backup.
Solution
SGI have chosen not to co-operate on resolving this issue. However, a workaround is possible:
Alter the permissions on any current database dumps (this should be run/checked on all service nodes)
# chmod 600 /etc/dbdump.dbWithin the file /etc/opt/sgi/conf.d/80-update-mysql find the following section of code:
command = “mysqldump --user=root --pass=" + password + " --all-databases --master-data > /etc/dbdump.db”Alter this to the following, in order to ensure the more secure permissions persist reboots:
command = “mysqldump --user=root --pass=" + password + " --all-databases --master-data > /etc/dbdump.db; chmod 600 /etc/dbdump.db”SGI have chosen not to cooperate in the co-ordinated disclosure of this and other SGI related security issues. We are therefore unable to provide specific version information and other details surrounding this issue. Whilst every effort has been made to ensure the accuracy and usefulness of this advisory it is recommend that SGI are contacted directly if further information is required.
Timeline
2014-02-11: Contact with SGI established
2014-02-20: Full vulnerability details provided to SGI
2014-04-14: Vulnerabilities acknowledged and response provided
2014-05-23: Update requested (not provided)
2014-07-23: Update requested (not provided)
2014-11-20: Contact with SGI re-attempted
2014-12-02: Advisory published