PT-2003-2030 · Oracle · Solaris

Wojciech Purczynski · Published 2003-12-31 · Updated 2018-10-30 · CVE-2003-1073

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Solaris versions 2.6 through 9

Description A race condition exists in the at command, allowing local users to delete arbitrary files by utilizing the -r argument with .. (dot dot) sequences in the job name. This is achieved by modifying the directory structure after the at command checks permissions to delete the file, but before the deletion actually takes place.

Recommendations For Solaris versions 2.6 through 9, consider restricting access to the at command until a fix is available, or apply configuration changes to prevent the exploitation of this issue. As a temporary workaround, consider disabling the at command for local users to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2003-1073

Affected Products

Solaris

References · 13

• 🔥 https://exploit-db.com/exploits/22203 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1073 · Security Note
• http://secunia.com/advisories/7960 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-50161-1 · Vendor Advisory
• http://ciac.org/ciac/bulletins/n-070.shtml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11179 · Note
• http://securityfocus.com/bid/6692 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11180 · Note
• http://securitytracker.com/id?1005994 · Note
• http://securityfocus.com/bid/6693 · Note
• http://isec.pl/vulnerabilities/isec-0008-sun-at.txt · Note
• http://securityfocus.com/archive/1/308577 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0044.html · Note