OSVDB ID: 5582 Title: IBM AIX lsfs Environment Path Local Privilege Escalation |
Info |
|
|
Dates |
||||
|
|
Description |
AIX contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the command lsfs is installed with the SUID bit and calls commands modified by an attacker. This flaw may lead to a loss of confidentiality and/or integrity. |
Classification |
Location:
Local Access Required
Attack Type: Input Manipulation, Other Impact: Loss of Confidentiality, Loss of Integrity, Loss of Availability Exploit: Exploit Public Disclosure: OSVDB Verified |
Solution |
Apply APAR IY16909 patch or upgrade to AIX 5.1 as both have been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: Use the chmod -s command to remove the setuid bit from lsfs. |
Products |
|
References |
Credit |
|