PT-2007-6769 · Ibm · Ibm Aix

Published 2007-11-05 · Updated 2017-07-29 · CVE-2007-5804

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM AIX versions 5.2 through 5.3

Description The issue allows local users in the system group to create or overwrite an arbitrary file and enable world writability of this file by using the file's name as the argument to the "-p" option in swcons.

Recommendations For IBM AIX versions 5.2 through 5.3, consider restricting access to the swcons command and the cfgcon utility to prevent unauthorized file creation or modification. As a temporary workaround, consider disabling the use of the "-p" option in swcons until a proper fix is available.

Fix

Related Identifiers

CVE-2007-5804

Affected Products

Ibm Aix

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-5804 · Security Note
• http://securityfocus.com/bid/26258 · Patch
• http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03055 · Vendor Advisory
• http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX53&path=%2F200710%2FSECURITY%2F20071030%2Fdatafile100405 · Patch
• http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03061 · Vendor Advisory
• ftp://aix.software.ibm.com/aix/efixes/security/cfgcon_ifix.tar · Patch
• http://secunia.com/advisories/27437 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=611 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38154 · Note