SGI Tempo System Database Exposure

CVE-2014-7303

    Type

  • SGI Tempo System Database Exposure
  • Severity

  • Low
  • Affected products

  • SGI Tempo (SGI ICE-X Supercomputers)
  • Affected Versions

  • Unknown
  • Vendor

  • Silicon Graphics International Corp (SGI)
  • Vendor Response

  • Uncooperative
  • Authors

  • John Fitzpatrick MWR Labs
  • CVE Reference

  • CVE-2014-7303
Timeline

SGI have chosen not to co-operate with MWR in the co-ordinated disclosure of this and other SGI related security issues. MWR are therefore unable to provide specific version information and other details. Whilst every effort has been made to ensure the accuracy and usefulness of this advisory it is recommend that SGI are contacted directly if further information is required.

2014-02-11Contact with SGI established
2014-02-20Full vulnerability details provided to SGI
2014-04-14Vulnerabilities acknowledged and response provided
2014-05-23Update requested by MWR (not provided)
2014-07-23Update requested by MWR (not provided)
2014-11-20Contact with SGI re-attempted
2014-12-02Advisory published

Description

It is possible for users of ICE-X supercomputers to gain access to backups of system configuration databases.

Impact

The impact depends on the type of information held within this database. More recent versions of Tempo store root password hashes in the database, while in earlier versions of Tempo the impact is believed to me more limited.

Cause

Insecure (world readable) file permissions are set on the database backup.

Solution

SGI have chosen not to co-operate on resolving this issue. However, a workaround is possible:

  • Alter the permissions on any current database dumps (this should be run/checked on all service nodes)

# chmod 600 /etc/dbdump.db

  • Within the file /etc/opt/sgi/conf.d/80-update-mysql find the following section of code:

command = “mysqldump --user=root --pass=" + password + " --all-databases --master-data > /etc/dbdump.db”

  • Alter this to the following, in order to ensure the more secure permissions persist reboots:

command = “mysqldump --user=root --pass=" + password + " --all-databases --master-data > /etc/dbdump.db; chmod 600 /etc/dbdump.db”

SGI have chosen not to cooperate with MWR in the co-ordinated disclosure of this and other SGI related security issues. MWR are therefore unable to provide specific version information and other details surrounding this issue. Whilst every effort has been made to ensure the accuracy and usefulness of this advisory it is recommend that SGI are contacted directly if further information is required.