Exploitation Summary
EIP tracks 2 public exploits for CVE-2000-1009. PoCs published by mat.
AI-analyzed exploit summary This exploit leverages a vulnerability in dump/restore utilities (CVE-2000-1009) where the TAPE environment variable is improperly handled, allowing execution of arbitrary commands with elevated privileges. It creates a malicious script and executes it via the vulnerable binary to gain a SUID root shell.
Description
dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program.
Exploits (2)
This exploit leverages a vulnerability in dump/restore utilities (CVE-2000-1009) where the TAPE environment variable is improperly handled, allowing execution of arbitrary commands with elevated privileges. It creates a malicious script and executes it via the vulnerable binary to gain a SUID root shell.
This exploit leverages a vulnerability in the `dump` command (version 0.4b15) on Red Hat 6.2, where improper handling of the `TAPE` and `RSH` environment variables allows execution of arbitrary commands with root privileges. The script creates a malicious `/tmp/rsh` script that copies `/bin/sh` to `/tmp/sush` and sets the SUID bit, enabling a root shell.