PT-2013-4089 · Ibm · Ibm Aix+1

Published 2013-07-06 · Updated 2017-09-19 · CVE-2013-3005

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM AIX versions 6.1 and 7.1 VIOS version 2.2.2.2-FP-26 SP-02

Description The issue allows remote authenticated users to bypass intended file-ownership restrictions and read or overwrite arbitrary files when RBAC is enabled.

Recommendations For IBM AIX versions 6.1 and 7.1, consider disabling RBAC until a patch is available to prevent the bypass of file-ownership restrictions. For VIOS version 2.2.2.2-FP-26 SP-02, restrict access to sensitive files to minimize the risk of exploitation until a fix is applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-3005

Affected Products

Ibm Aix

Vios

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2013-3005 · Security Note
• http://ibm.com/support/docview.wss?uid=isg1IV42934 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV42935 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV42932 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV42933 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV40221 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV42700 · Vendor Advisory
• http://aix.software.ibm.com/aix/efixes/security/tftp_advisory.asc · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19519 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85366 · Note