Sun Solaris ASPPPLS Insecure Temporary File Creation Vulnerability

Bugtraq ID:	5698
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 12 2002 12:00AM
Updated:	Sep 12 2002 12:00AM
Credit:	Vulnerability discovery credited to Kevin Kotas of eSecurityOnline.
Vulnerable:	Sun Solaris 8_x86 Sun Solaris 8_sparc
Not Vulnerable:

Sun Solaris ASPPPLS Insecure Temporary File Creation Vulnerability

Solaris is the UNIX Operating System variant distributed and maintained by Sun Microsystems.

aspppls creates insecure temporary files. aspppls is a setuid root application that when executed will create temporary files with root privileges. This could result in a local attacker launching a symbolic link attack to overwrite root-owned files.

It should be noted that this vulnerability is likely related to Bugtraq ID 292 titled "Solaris aspppd Insecure Temporary File Creation Vulnerability."

Sun Solaris ASPPPLS Insecure Temporary File Creation Vulnerability

Solution:
Fixes available:


Sun Solaris 8_x86

• Sun 111300-04
  http://sunsolve.sun.com

Sun Solaris 8_sparc

• Sun 111299-04
  http://sunsolve.sun.com

Sun Solaris ASPPPLS Insecure Temporary File Creation Vulnerability

References:

• Sun Alert ID: 46903 (Sun Microsystems)