PT-2009-4256 · Ibm · Libc+1

Affix · Publicado 2009-05-26 · Atualizado 2017-09-29 · CVE-2009-1786

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: IBM AIX versions 5.3 through 6.1

Description: The issue concerns the malloc subsystem in libc, which allows local users to create or overwrite arbitrary files via a symlink attack on the log file associated with the MALLOCDEBUG environment variable.

Recommendations: For IBM AIX versions 5.3 through 6.1, consider restricting access to the MALLOCDEBUG environment variable to prevent exploitation. As a temporary workaround, avoid using the MALLOCDEBUG environment variable until a patch is available.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2009-1786

Produtos afetados

Aix

Libc

Referências · 19

• 🔥 https://exploit-db.com/exploits/9306 · Exploit
• 🔥 https://exploit-db.com/exploits/33001 · Exploit
• http://ibm.com/support/docview.wss?uid=isg1IZ50445 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=isg1IZ50121 · Aviso do Fabricante
• http://secunia.com/advisories/35146 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=isg1IZ50139 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1786 · Nota de Segurança
• http://aix.software.ibm.com/aix/efixes/security/libc_advisory.asc · Aviso do Fabricante
• http://securitytracker.com/id?1022261 · Correção
• http://ibm.com/support/docview.wss?uid=isg1IZ50517 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=isg1IZ50129 · Aviso do Fabricante
• http://securityfocus.com/bid/35034 · Nota
• http://ibm.com/support/docview.wss?uid=isg1IZ50447 · Aviso do Fabricante
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=802 · Nota
• http://vupen.com/english/advisories/2009/1380 · Aviso do Fabricante