[SGI Tempo System Database Exposure]

Software: SGI Tempo (SGI ICE-X Supercomputers)
Affected Versions: Unknown
CVE Reference: CVE-2014-7303
Author: John Fitzpatrick, MWR Labs
Severity: Low Risk
Vendor: Silicon Graphics International Corp (SGI)
Vendor Response: Uncooperative

[Description]

It is possible for users of ICE-X supercomputers to gain access to backups of system configuration databases.

[Impact]

The impact depends on the type of information held within this database. More recent versions of Tempo store root password hashes in the database, while in earlier versions of Tempo the impact is believed to me more limited.

[Cause]

Insecure (world readable) file permissions are set on the database backup.

[Solution]

SGI have chosen not to co-operate on resolving this issue. However, a workaround is possible:

• Alter the permissions on any current database dumps (this should be run/checked on all service nodes)

chmod 600 /etc/dbdump.db

• Within the file /etc/opt/sgi/conf.d/80-update-mysql find the following section of code:

command = “mysqldump --user=root --pass=" + password + " --all-databases --master-data > /etc/dbdump.db”

• Alter this to the following, in order to ensure the more secure permissions persist reboots:

command = “mysqldump --user=root --pass=" + password + " --all-databases --master-data > /etc/dbdump.db; chmod 600 /etc/dbdump.db”

SGI have chosen not to cooperate with MWR in the co-ordinated disclosure of this and other SGI related security issues. MWR are therefore unable to provide specific version information and other details surrounding this issue. Whilst every effort has been made to ensure the accuracy and usefulness of this advisory it is recommend that SGI are contacted directly if further information is required.

[Detailed Timeline]

2014-02-11: Contact with SGI established
2014-02-20: Full vulnerability details provided to SGI
2014-04-14: Vulnerabilities acknowledged and response provided
2014-05-23: Update requested by MWR (not provided)
2014-07-23: Update requested by MWR (not provided)
2014-11-20: Contact with SGI re-attempted
2014-12-02: Advisory published

https://labs.mwrinfosecurity.com/advisories/2014/12/02/sgi-tempo-system-database-exposure/