Sun Solaris AT Command Arbitrary File Deletion Vulnerability

Bugtraq ID:	6692
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 27 2003 12:00AM
Updated:	Jan 27 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Wojciech Purczynski <[email protected]>.
Vulnerable:	Sun Solaris 2.5.1 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5
Not Vulnerable:

Sun Solaris AT Command Arbitrary File Deletion Vulnerability

The at utility shipped with Sun Solaris may be prone to an issue which may allow attackers to delete arbitrary files on the system.

The vulnerability occurs when using at with the '-r' option. This option is used to remove previously scheduled at jobs. The vulnerability exists because at does not properly sanitize parameters submitted as part of the -r commandline option.

A local attacker can cause at to delete arbitrary files on the system.

Sun Solaris AT Command Arbitrary File Deletion Vulnerability

The following proof of concept was provided:

/usr/bin/at -r ../../../../tmp/foo

Sun Solaris AT Command Arbitrary File Deletion Vulnerability

Solution:
The vendor has supplied the following fixes:


Sun Solaris 2.6

• Sun 105181-34
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=105181&rev=34

Sun Solaris 7.0

• Sun 108319-03
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=108319&rev=03

Sun Solaris 8_x86

• Sun 108876-13
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=108876&rev=13


• Sun 109008-09
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=109008&rev=09

Sun Solaris 2.6_x86

• Sun 105182-34
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=105182&rev=34

Sun Solaris 8_sparc

• Sun 108875-13
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=108875&rev=13


• Sun 109007-09
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=109007&rev=09

Sun Solaris 9

• Sun 114135-01
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=114135&rev=01

Sun Solaris 9_x86

• Sun 114136-01
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=114136&rev=01

Sun Solaris 7.0_x86

• Sun 108320-03
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=108320&rev=03

Sun Solaris AT Command Arbitrary File Deletion Vulnerability

References:

• Security Vulnerability with the at(1) Command on Solaris (Sun Microsystems)
  
• Sun Microsystems Solaris at -r job name handling and race condition (Wojciech Purczynski )