CVE-1999-0864

UnixWare - Local Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-1999-0864. PoCs published by Brock Tellier.

AI-analyzed exploit summary This exploit leverages a symlink attack on UnixWare 7.1 by forcing an SGID program to dump core and overwrite a system-critical file via a guessed PID. The script creates a symlink to a writable system file and triggers a core dump in 'arp' by overflowing its input.

Description

UnixWare programs that dump core allow a local user to modify files via a symlink attack on the ./core.pid file.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Brock Tellier · bashlocalsco

https://www.exploit-db.com/exploits/19659

View Code ZIP pw:eip

This exploit leverages a symlink attack on UnixWare 7.1 by forcing an SGID program to dump core and overwrite a system-critical file via a guessed PID. The script creates a symlink to a writable system file and triggers a core dump in 'arp' by overflowing its input.

Classification

Working Poc 90%

Attack Type

Lpe

Complexity

Trivial

Reliability

Racy

Target: SCO UnixWare 7.1

No auth needed

Prerequisites: SGID binary that can be forced to core dump · write access to a directory where the core dump will be created · ability to guess or predict the PID of the target process

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1222 - File and Directory Permissions Modification

devstral-2 · analyzed Feb 16, 2026 Full analysis →