Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-4454. PoCs published by Dominick LaTrappe.
AI-analyzed exploit summary This exploit leverages a time-of-check to time-of-use (TOCTOU) race condition in VideoCache's vccleaner utility to append arbitrary data to privileged files. By manipulating file timestamps and symlinks, an attacker with Squid proxy privileges can inject commands into root-owned files like /etc/rc.local.
Description
vccleaner in VideoCache 1.9.2 allows local users with Squid proxy user privileges to overwrite arbitrary files via a symlink attack on /var/log/videocache/vccleaner.log.
Exploits (1)
This exploit leverages a time-of-check to time-of-use (TOCTOU) race condition in VideoCache's vccleaner utility to append arbitrary data to privileged files. By manipulating file timestamps and symlinks, an attacker with Squid proxy privileges can inject commands into root-owned files like /etc/rc.local.