PT-2007-6770 · Ibm · Ibm Aix

Publicado 2007-11-05 · Atualizado 2017-07-29 · CVE-2007-5805

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM AIX versions 5.2 through 5.3

Description The issue is related to the cfgcon in IBM AIX, which does not properly validate the argument to the "-p" option to swcons. This allows local users in the system group to create an arbitrary file and enable world writability of this file via a symlink attack involving use of the file's name as the argument.

Recommendations For IBM AIX versions 5.2 through 5.3, consider restricting access to the swcons command with the "-p" option to prevent arbitrary file creation and modification. As a temporary workaround, consider disabling the use of the "-p" option in swcons until a proper fix is applied.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2007-5805

Produtos afetados

Ibm Aix

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-5805 · Nota de Segurança
• http://secunia.com/advisories/27437 · Nota
• http://securityfocus.com/bid/26258 · Correção
• http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03055 · Aviso do Fabricante
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=611 · Nota
• http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX53&path=%2F200710%2FSECURITY%2F20071030%2Fdatafile100405 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38154 · Nota
• http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03061 · Aviso do Fabricante
• ftp://aix.software.ibm.com/aix/efixes/security/cfgcon_ifix.tar · Correção