Executive brief
A security vulnerability exists in the Solaris 'ps' command, a standard utility used to view running system processes. A local attacker can exploit a timing flaw to overwrite critical system files. This could lead to a complete system compromise, data loss, or a total service outage by corrupting essential operating system components.
Technical details
A race condition exists in the Solaris 'ps' utility, which is typically installed with setuid root privileges. By exploiting a time-of-check to time-of-use (TOCTOU) flaw during file operations, a local unprivileged user can redirect file writes to arbitrary locations on the filesystem. This allows for the overwriting of critical system files with attacker-controlled data. Successful exploitation requires precise timing but can result in full system compromise (elevation of privilege) or a denial-of-service condition. The vulnerability was originally identified in 1995.
Affected products
- Sun Microsystems Solaris
Timeline
- 1995-08-29: disclosed