CVE-1999-1026

Step 1: Symlink Creation: The attacker creates a symbolic link named /tmp/.asppp.fifo that points to a sensitive system file, such as /etc/shadow or /etc/passwd.

Step 2: Triggering aspppd: The attacker triggers the aspppd daemon, typically by initiating a PPP connection or through other means that cause it to create and interact with the FIFO.

Step 3: Race Condition: The aspppd daemon attempts to write data to /tmp/.asppp.fifo.

Step 4: File Overwrite: Because the symlink is in place, the data intended for the FIFO is instead written to the target file (e.g., /etc/shadow), allowing the attacker to overwrite the file and potentially gain root access by adding a user with a known password or modifying existing user credentials.

The vulnerability stems from a race condition in how aspppd handles the /tmp/.asppp.fifo file. The daemon, running with elevated privileges, creates this FIFO (named pipe) in /tmp. An attacker can exploit this by creating a symbolic link pointing to a critical system file (e.g., /etc/shadow) before aspppd attempts to interact with the FIFO. The daemon, unaware of the symlink, will then write data intended for the FIFO to the target file, allowing the attacker to overwrite it. This is a classic example of a TOCTOU (Time-of-Check to Time-of-Use) vulnerability. The root cause is the lack of proper input validation and secure file handling practices, specifically the failure to check if the file is a symlink before writing to it.