Description
Check Point FireWall-1 3.0b through 4.1 for Solaris allows local users to overwrite arbitrary files via a symlink attack on temporary policy files that end in a .cpp extension, which are set world-writable.
References
- 3300 vdb-entry
- fw1-tmp-file-symlink(7094) vdb-entry
- 20010908 Bug in compile portion for older versions of CheckPoint Firewalls mailing-list