CVE-2003-1024

Vulnerability

An unknown vulnerability exists in the built-in ls-F function of the tcsh shell on Solaris 8. The flaw allows a local user to create or delete files as another user. Only Solaris 8 is affected; Solaris 7 and 9 are not vulnerable [1].

Exploitation

An attacker must have local access to a Solaris 8 system and be able to execute tcsh with the ls-F builtin. The exact exploitation method is not publicly disclosed, but the vulnerability can be triggered by a local user without special privileges [1].

Impact

A successful exploit enables the attacker to create or delete files as another user, potentially gaining the privileges of that user, including root. This compromises file integrity and availability and can lead to full privilege escalation [1].

Mitigation

No official patch was released by Sun for this vulnerability. The CERT/CC vulnerability note does not provide any workaround or mitigation steps [1]. Users may consider restricting access to tcsh or using an alternative shell as a precaution.