PT-2016-3250 · Ibm · Aix+1

Hxmonsegur · Published 2016-10-31 · Updated 2021-08-31 · CVE-2016-6079

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM AIX versions 5.3 through 7.2

Description The issue is related to the Logical Volume Manager (LVM) system in AIX, which has inadequate access control. This allows a locally authenticated user to potentially gain root level privileges by exploiting the vulnerability, possibly using the lquerylv command.

Recommendations For IBM AIX versions 5.3 through 7.2, apply the fixes according to IBM APARs: IV88658, IV87981, IV88419, IV87640, IV88053 to resolve the issue. As a temporary workaround, consider restricting access to the LVM system until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2018-00382

CVE-2016-6079

Affected Products

Aix

Ibm Aix

References · 8

• 🔥 https://exploit-db.com/exploits/40710 · Exploit
• https://bdu.fstec.ru/vul/2018-00382 · Security Note
• http://aix.software.ibm.com/aix/efixes/security/lquerylv_advisory.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6079 · Security Note
• https://t.me/cvenotify/20448 · Telegram Post
• http://securitytracker.com/id/1037256 · Note
• http://securityfocus.com/bid/94090 · Note