Dynamic Linkers Profiling
A vulnerability in the dynamic linkers while profiling a shared object allows local users to create arbitrary files in the system. This exploit uses the LD_PROFILE environment variable to instruct the dynamic linker to profile the shared object defined by it. When profiling is enabled, a profiling buffer file is created and mapped. The name of the buffer file is the name of the shared object being profiled with a .profile extension. By default this buffer is placed under /var/tmp. The dynamic linker created the buffer file insecurely in the case where it runs in the context of a setuid application. It follows symbolic links while creating the file. This exploit creates a symbolic link to the .rhosts file and then runs the ps command to create the buffer file. This allows the user to create the .rhosts file and then use rsh to gain root access.
