Classic Unix Security Problems

Race conditions

     lrwxrwxrwx    1 mjd      users           7 Dec  7 16:30 bogus.pl -> real.pl
     -rwsr-xr-x    1 root     wheel         977 Dec  7 16:30 real.pl

Then I run bogus.pl
1. The kernel sees that bogus.pl is a setuid script
2. It reads real.pl to find the interpreter name
3. Then it will run /usr/bin/perl bogus.pl
In between (2) and (3), I remove bogus.pl
- I replace it with a link to my-evil-script.pl
My evil script is now running as root