Exploitation Summary
EIP tracks 2 public exploits for CVE-2000-1134. PoCs published by t--zen, proton.
AI-analyzed exploit summary This exploit leverages multiple vulnerabilities in Red Hat 6.1, including a symlink attack via uucp and predictable file creation in /tmp by bash, to ultimately achieve root privilege escalation. It replaces /usr/sbin/uuconv with a malicious binary that copies a setuid bash shell to the attacker's directory.
Description
Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.
Exploits (2)
This exploit leverages multiple vulnerabilities in Red Hat 6.1, including a symlink attack via uucp and predictable file creation in /tmp by bash, to ultimately achieve root privilege escalation. It replaces /usr/sbin/uuconv with a malicious binary that copies a setuid bash shell to the attacker's directory.
This exploit demonstrates a symbolic link attack in Unix shells (bash, tcsh, ksh, sh) due to predictable /tmp file naming and lack of existence checks. It allows local privilege escalation or file corruption by manipulating shell redirection operators.