PT-2009-5064 · Ibm · Aix

Karol Wiesek

·

Publicado

2009-08-05

·

Atualizado

2009-08-12

·

CVE-2009-2669

CVSS v2.0

7.2

Alta

VetorAV:L/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions IBM AIX versions 5.3 through 6.1
Description The issue is related to a debugging component that does not properly handle the LIB INIT DBG and LIB INIT DBG FILE environment variables. This allows local users to gain privileges by leveraging a setuid-root program to create an arbitrary root-owned file with world-writable permissions. The problem is associated with the libC.a (also known as the XL C++ runtime library) in AIX 5.3 and libc.a in AIX 6.1.
Recommendations For IBM AIX versions 5.3 through 6.1, consider restricting access to setuid-root programs to minimize the risk of exploitation. As a temporary workaround, avoid using the LIB INIT DBG and LIB INIT DBG FILE environment variables in sensitive operations until a patch is available.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-2669

Produtos afetados

Aix