[irix-security] IRIX cron daemon vulnerability

[Martin Siegert <siegert@sfu.ca>]

Topic
=====
insecure creation of temporary files by the cron daemon can lead to
root exploit.

Problem Description
===================
IRIX's cron daemon uses predictably named temporary files, and that under
certain circumstances this can lead to a root exploit.
These vulnerabilities may be not exploited by a remote user, a local
account is required.

Affected Systems
================
The cron binary is installed by default on IRIX 6.5 systems as part of
eoe.sw.base.
This issue has been corrected in IRIX 6.5.10 and later versions.

Solution
========
SGI has not released any patches to address this problem.
They recommend upgrade to IRIX 6.5.10 or later.

   OS Version     Vulnerable?
   ----------     -----------
   IRIX 6.5          yes
   IRIX 6.5.1        yes
   IRIX 6.5.2        yes
   IRIX 6.5.3        yes
   IRIX 6.5.4        yes
   IRIX 6.5.5        yes
   IRIX 6.5.6        yes
   IRIX 6.5.7        yes
   IRIX 6.5.8        yes
   IRIX 6.5.9        yes
   IRIX 6.5.10       no
   IRIX 6.5.11       no
   IRIX 6.5.12       no
   IRIX 6.5.13       no
   IRIX 6.5.14       no
   IRIX 6.5.15       no