PT-2007-4926 · Ibm · Ibm Aix+1

Published 2007-07-11 · Updated 2017-07-29 · CVE-2007-3680

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM AIX versions 5.2.0 through 5.3.0

Description The issue is related to a stack-based buffer overflow in the odm searchpath function within the libodm library. This allows local users to execute arbitrary code by manipulating the ODMPATH environment variable, specifically by making it excessively long.

Recommendations For IBM AIX versions 5.2.0 through 5.3.0, consider restricting access to the odm searchpath function until a patch is available. As a temporary workaround, limit the length of the ODMPATH environment variable to prevent exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-3680

Affected Products

Ibm Aix

Libodm

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-3680 · Security Note
• http://www-1.ibm.com/support/docview.wss?uid=isg1IY97632 · Vendor Advisory
• http://securitytracker.com/id?1018345 · Vendor Advisory
• http://secunia.com/advisories/25970 · Vendor Advisory
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=552 · Patch
• http://osvdb.org/36760 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35321 · Note
• http://vupen.com/english/advisories/2007/2476 · Note
• ftp://aix.software.ibm.com/aix/efixes/security/README · Note
• http://securityfocus.com/bid/24841 · Note