Solaris 7.0 aspppd Insecure Temporary File Creation Vulnerability. CVE-1999-1026. Local exploit for solaris platform
source: http://www.securityfocus.com/bid/292/info Aspppd is a tool shipped with Solaris for dial up PPP access. This tool creates files in the /tmp directory insecurely (in particular /tmp/.asppp.fifo) allowing other users to link to these files an possibly elevate their privelages. This program is not by default shipped with SUID root privelages so an attacker will therefore only be able to write to files (via a symlink attack) as the user exectuing aspppd. $ echo "+ +" >> .rhosts $ ln -s /.rhosts /tmp/.asppp.fifo Wait for asppd to be excecuted.