Sun Solaris 'inetd(1M)' Daemon Insecure Temporary File Creation Vulnerability

Bugtraq ID:	28584
Class:	Race Condition Error
CVE:	CVE-2008-1684
Remote:	No
Local:	Yes
Published:	Apr 02 2008 12:00AM
Updated:	May 07 2015 05:30PM
Credit:	The vendor
Vulnerable:	Sun Solaris 10_x86 Sun Solaris 10_sparc Avaya Interactive Response 2.0
Not Vulnerable:

Sun Solaris 'inetd(1M)' Daemon Insecure Temporary File Creation Vulnerability

Sun Solaris 'inetd(1M)' creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

This issue affects Sun Solaris 10 for SPARC and x86 platforms.

Sun Solaris 'inetd(1M)' Daemon Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit this issue.

Sun Solaris 'inetd(1M)' Daemon Insecure Temporary File Creation Vulnerability

Solution:
The vendor has released an advisory. Please see the references for more information.