Exploitation Summary
EIP tracks 3 public exploits for CVE-2016-6253.
PoCs published by Metasploit, akat1, h00die <[email protected]>, akat1, including Metasploit module exploits/unix/local/netbsd_mail_local.
AI-analyzed exploit summary This exploit leverages a race condition in NetBSD's mail.local to escalate privileges by overwriting the atrun binary with a malicious script. It requires a root-owned crontab job to trigger execution.
Description
mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.
Exploits (3)
This exploit leverages a race condition in NetBSD's mail.local to escalate privileges by overwriting the atrun binary with a malicious script. It requires a root-owned crontab job to trigger execution.
This exploit leverages a race condition in the `atrun` utility to overwrite the binary with a malicious script, granting a root shell via a setuid `ksh` binary. It requires local access and precise timing to win the race condition.
This exploit leverages a race condition in NetBSD's mail.local to escalate privileges by overwriting the atrun binary with a malicious script. It requires a root-owned crontab job to execute and can take up to 10 minutes to trigger.
References (8)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H