Exploitation Summary
EIP tracks 4 public exploits for CVE-2001-0095. PoCs published by lwc, Shane Hird, Vapid Labs.
AI-analyzed exploit summary This exploit targets a race condition in catman (CVE-2001-0095) by monitoring the process list for catman, predicting its PID, and creating a symlink in /tmp to overwrite /etc/passwd. It relies on system speed and process load timing.
Description
catman in Solaris 2.7 and 2.8 allows local users to overwrite arbitrary files via a symlink attack on the sman_PID temporary file.
Exploits (4)
This exploit targets a race condition in catman (CVE-2001-0095) by monitoring the process list for catman, predicting its PID, and creating a symlink in /tmp to overwrite /etc/passwd. It relies on system speed and process load timing.
This exploit leverages a race condition in the `catman` utility on Solaris 2.7, which insecurly creates files in `/tmp` based on the PID. The script creates symlinks in `/tmp` to a target file (e.g., `/etc/passwd`) and monitors for `catman` execution to overwrite the target file.
This exploit leverages a symbolic link race condition in Solaris's catman utility to overwrite arbitrary files. It monitors the process list for catman, predicts the temporary file name based on PID, and creates a symlink to a target file (e.g., /etc/passwd) to achieve file corruption or privilege escalation.
This exploit targets a symbolic link vulnerability in Solaris catman (CVE-2001-0095), allowing local users to overwrite arbitrary files by creating symlinks in /tmp. The script generates multiple symlinks to a target file (e.g., /etc/passwd) and monitors for catman execution to trigger the overwrite.