CVE-1999-0860

Solaris chkperm vulnerability allows local users to read files owned by bin via the VMSYS environment variable and a symlink attack. The affected software is the Solaris chkperm utility; the vulnerability arises from a symlink-based access path involving VMSYS, leading to a partial confidentialit...

solaris.chkperm+arp.txt

Greetings, OVERVIEW /usr/vmsys/bin/chkperm and /usr/sbin/arp can be used to read bin-owned files. BACKGROUND All my testing was done on Solaris 2.7 and 2.6 SPARC edition. DETAILS Vuln 1 - chkperm This one isn't nearly as interesting as the instant-shell variety. Here's how it works: chkperm is...