CVE-2000-0703
perl - Local Privilege Escalation via suidperl Escape Sequence Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2000-0703. PoCs published by Michal Zalewski, Sebastian Krahmer.
AI-analyzed exploit summary This exploit leverages a race condition in suidperl combined with an undocumented feature in /bin/mail to execute arbitrary commands as root. It creates a malicious filename with embedded shell commands and triggers suidperl's security check failure to send a mail notification, which then executes the commands via the 'interactive' environment variable.
Description
suidperl (aka sperl) does not properly cleanse the escape sequence "~!" before calling /bin/mail to send an error report, which allows local users to gain privileges by setting the "interactive" environmental variable and calling suidperl with a filename that contains the escape sequence.
Exploits (2)
This exploit leverages a race condition in suidperl combined with an undocumented feature in /bin/mail to execute arbitrary commands as root. It creates a malicious filename with embedded shell commands and triggers suidperl's security check failure to send a mail notification, which then executes the commands via the 'interactive' environment variable.
This exploit leverages a race condition in suidperl combined with an undocumented feature in /bin/mail to execute arbitrary commands as root. The attack involves manipulating symlinks and environment variables to trigger a root shell via /bin/mail's interactive mode.