CVE-1999-1138

Step 1: Identify Target: Identify a SCO UNIX system running a vulnerable version.

Step 2: User Account Enumeration: Determine the existence of the dos and asg user accounts (or other accounts with home directories in world-writable locations).

Step 3: File Manipulation: Create or modify files within /tmp (for dos) or /usr/tmp (for asg). This could involve placing malicious .profile or .bashrc files to execute commands upon login.

Step 4: Account Access: Wait for the target user (e.g., dos or asg) to log in. The malicious code in the manipulated configuration files will execute.

Step 5: Privilege Escalation: The attacker now has access to the target user's account, potentially allowing further privilege escalation or data exfiltration.

The vulnerability stems from a flawed configuration during the installation of SCO UNIX System V/386 Release 3.2 and other SCO products. The installation process creates home directories for the dos and asg users within world-writable temporary directories (/tmp and /usr/tmp, respectively). This configuration error allows any user to create, modify, or delete files within these directories, effectively allowing them to manipulate the contents of the users' home directories. This is a classic privilege escalation vulnerability. The root cause is the failure to properly secure the temporary directories, leading to a weak access control configuration.