CVE-2003-1073 A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. (dot dot) sequences in the job name, then modifying the directory....
LowCVSS 1.2
EPSS 0.70%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. (dot dot) sequences in the job name, then modifying the directory structure after at checks permissions to delete the file and before the deletion actually takes place.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun solaris | = 2.6 | No fix listed |
| sun solaris | = 7.0 | No fix listed |
| sun solaris | = 8.0 | No fix listed |
| sun solaris | = 9.0 | No fix listed |
| sunos | All versions | No fix listed |
| sunos | = 5.5 | No fix listed |
| sunos | = 5.5.1 | No fix listed |
| sunos | = 5.7 | No fix listed |
| sunos | = 5.8 | No fix listed |
References
- 20030127 Sun Microsystems Solaris at -r job name handling and race condition vulnerabilities mailing-list
- isec.pl
- 7960 patch third-party-advisory
- 50161 vendor-advisory
- N-070 government-resource third-party-advisory
- 20030127 Sun Microsystems Solaris at -r job name handling and race condition vulnerabilities mailing-list
- 6692 vdb-entry
- 6693 vdb-entry
- 1005994 vdb-entry
- solaris-at-directory-traversal(11179) vdb-entry
- solaris-at-race-condition(11180) vdb-entry