Executive brief
A vulnerability in the Solaris dial-up networking service (aspppd) allows a local user to gain full administrative control of the system. By creating a malicious link to a sensitive system file, an attacker can trick the service into making that file world-writable. This could lead to the theft of sensitive data, permanent system compromise, or a complete service outage.
Technical details
The aspppd daemon in Solaris 2.5 x86 is vulnerable to a symlink attack via the /tmp/.asppp.fifo file. Because the daemon creates or opens this file in a world-writable directory without proper validation, a local attacker can create a symbolic link from /tmp/.asppp.fifo to an arbitrary system file (such as /.rhosts). When aspppd is subsequently executed by root, it opens the target file as a FIFO; once the process terminates, the target file's permissions may be left in a state that allows the attacker to modify it. This allows for local privilege escalation to root. The attack requires the daemon to be restarted by root while the malicious symlink is in place.
Affected products
- Sun Microsystems Solaris 2.5 x86
Timeline
- 1996-12-20: disclosed: Initial discovery and post to Bugtraq mailing list
- 1996-12-20: advisory: NVD published date