CVE-2001-1479

Step 1: Target Selection: Identify a target file for deletion. This could be a sensitive system file like /etc/shadow, /etc/passwd, or a critical configuration file.

Step 2: Symlink Creation: Create a symbolic link named /tmp/smc$SMC_PORT (where $SMC_PORT is the port used by SMC, likely 161 or 1610) that points to the target file.

Step 3: Triggering smcboot: Trigger the smcboot process. This might involve interacting with the SMC service or restarting the SMC agent.

Step 4: Race Condition Exploitation: The smcboot process attempts to create a temporary file at /tmp/smc$SMC_PORT. Due to the race condition, it first attempts to delete the existing file at that location, which is now the symlink. This results in the deletion of the target file instead.

Step 5: Impact: The target file is deleted, potentially leading to system compromise or denial of service.

The vulnerability stems from a race condition within the smcboot process. This process, running with elevated privileges, creates a temporary file (/tmp/smc$SMC_PORT) and is susceptible to a symlink attack. An attacker can create a symbolic link pointing to a critical system file (e.g., /etc/shadow) before smcboot creates its temporary file. When smcboot attempts to create its temporary file, it inadvertently deletes the file pointed to by the symlink, leading to arbitrary file deletion. The flaw lies in the lack of proper input validation and secure file handling practices, specifically the failure to check the target of the symlink before deleting the file.