vulnwire
1.2low

CVE-2003-10731 exploit

A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. (dot…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
1.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 53%
Public exploits
1
Exploit-DB

A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. (dot dot) sequences in the job name, then modifying the directory structure after at checks permissions to delete the file and before the deletion actually takes place.

Exploit prediction (EPSS)

0.69% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.

Exploits and detections

  • EDB-22203 Sun Solaris 2.5/2.6/7.0/8/9 AT Command - Arbitrary File Deletion · local · 2003-01-27

CVSS scores

Assigned byVersionScoreVector
NVD2.01.2AV:L/AC:H/Au:N/C:N/I:P/A:N

References

  • securitytracker.com /id?1005994 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • isec.pl /vulnerabilities/isec-0008-sun-at.txt · x_refsource_MISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/11180 · vdb-entry, x_refsource_XF, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/11179 · vdb-entry, x_refsource_XF, x_transferred
  • archives.neohapsis.com /archives/vulnwatch/2003-q1/0044.html · mailing-list, x_refsource_VULNWATCH, x_transferred
  • securityfocus.com /archive/1/308577 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/7960/ · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/6693 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /bid/6692 · vdb-entry, x_refsource_BID, x_transferred
  • ciac.org /ciac/bulletins/n-070.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-50161-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.