https://www.exploit-db.com/exploits/22203
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-283

Solaris是一款由SunMicrosystems开发和维护的商业UNIX操作系统。Solaris包含的at命令不正确处理’-r’命令行参数，本地攻击者可以利用这个漏洞绕过限制目录删除atspool目录之外的作业。at命令包含’-r’选项，此选项用于删除以前预定的at作业，不过没有正确充分处理作为参数的作业ID数据，攻击者可以删除atspool目录之外的作业。不过at工具会验证文件属主和限制用户只删除自己的at作业。另at命令存在其他竞争条件漏洞结合此漏洞可删除系统任意文件。

source: http://www.securityfocus.com/bid/6692//info

The at utility shipped with Sun Solaris may be prone to an issue which may allow attackers to delete arbitrary files on the system.

The vulnerability occurs when using at with the '-r' option. This option is used to remove previously scheduled at jobs. The vulnerability exists because at does not properly sanitize parameters submitted as part of the -r commandline option.

A local attacker can cause at to delete arbitrary files on the system.

/usr/bin/at -r ../../../../tmp/foo

来源:SECUNIA
名称:7960
链接:http://secunia.com/advisories/7960/
来源:XF
名称:solaris-at-race-condition(11180)
链接:http://xforce.iss.net/xforce/xfdb/11180
来源:SUNALERT
名称:50161
链接:http://sunsolve.sun.com/search/document.do?assetkey=1-26-50161-1
来源:XF
名称:solaris-at-directory-traversal(11179)
链接:http://xforce.iss.net/xforce/xfdb/11179
来源:SECTRACK
名称:1005994
链接:http://www.securitytracker.com/id?1005994
来源:BID
名称:6693
链接:http://www.securityfocus.com/bid/6693
来源:BID
名称:6692
链接:http://www.securityfocus.com/bid/6692
来源:BUGTRAQ
名称:20030127SunMicrosystemsSolarisat-rjobnamehandlingandraceconditionvulnerabilities
链接:http://www.securityfocus.com/archive/1/308577
来源:CIAC
名称:N-070
链接:http://www.ciac.org/ciac/bulletins/n-070.shtml
来源:isec.pl
链接:http://isec.pl/vulnerabilities/isec-0008-sun-at.txt
来源:VULNWATCH
名称:20030127SunMicrosystemsSolarisat-rjobnamehandlingandraceconditionvulnerabilities
链接:http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0044.html
来源：NSFOCUS
名称：4291※4292
链接：http://www.nsfocus.net/vul