vendor:
Solaris
by:
SecurityFocus
7.2
CVSS
HIGH
Arbitrary File Deletion
78
CWE
Product Name: Solaris
Affected Version From: Sun Solaris 2.6
Affected Version To: Sun Solaris 9
Patch Exists: YES
Related CWE: N/A
CPE: o:sun:solaris
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Solaris
2002
Sun Solaris at Utility Arbitrary File Deletion Vulnerability
The at utility shipped with Sun Solaris may be prone to an issue which may allow attackers to delete arbitrary files on the system. The vulnerability occurs when using at with the '-r' option. This option is used to remove previously scheduled at jobs. The vulnerability exists because at does not properly sanitize parameters submitted as part of the -r commandline option. A local attacker can cause at to delete arbitrary files on the system.
Mitigation:
It is recommended that users upgrade to the latest version of Sun Solaris to address this issue.
