V-989

Discussion

If "at" programs are located in, or subordinate, to world-writable directories, they become vulnerable to removal and replacement by malicious users or system intruders.

Check Content

List any "at" jobs on the system.
Procedure:
# ls /var/spool/at /var/spool/atjobs

For each "at" job, determine which programs are executed by "at."
Procedure:
# more <at job file>

Check the directory containing each program executed by "at" for world-writable permissions.
Procedure:
# ls -la <at program file directory>

If "at" executes programs in world-writable directories, this is a finding.