Description
A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. (dot dot) sequences in the job name, then modifying the directory structure after at checks permissions to delete the file and before the deletion actually takes place.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Sun Solaris 2.5/2.6/7.0/8/9 AT Command - Arbitrary File Deletion EDB-22203 · local · Jan 27, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1005994 vdb-entry
- http://isec.pl/vulnerabilities/isec-0008-sun-at.txt
- solaris-at-race-condition(11180) vdb-entry
- solaris-at-directory-traversal(11179) vdb-entry
- 20030127 Sun Microsystems Solaris at -r job name handling and race condition vulnerabilities mailing-list
- 20030127 Sun Microsystems Solaris at -r job name handling and race condition vulnerabilities mailing-list
- 7960 third-party-advisory
- 6693 vdb-entry
- 6692 vdb-entry
- N-070 third-party-advisory government-resource
- 50161 vendor-advisory