IBM AIX Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence

IBM AIX Multiple Vulnerabilities
Secunia Advisory:	SA28609	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2008-01-24
Last Update:	2008-05-22
Popularity:	7,635 views

Critical:	Less critical
Impact:	Manipulation of data Exposure of sensitive information Privilege escalation
Where:	Local system
Solution Status:	Vendor Patch

OS:	AIX 5.x AIX 6.x

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2007-5764 CVE-2008-0584 CVE-2008-0585 CVE-2008-0586 CVE-2008-0587 CVE-2008-0588 CVE-2008-0589

Description: Some vulnerabilities have been reported in IBM AIX, which can be exploited by malicious, local users to disclose potentially sensitive information, manipulate certain files, or gain escalated privileges. 1) A boundary error in the pioout command can be exploited to cause a buffer overflow and execute arbitrary code with root privileges. 2) An unspecified error in the ps command allows users to access potentially sensitive information from an arbitrary process. The vulnerabilities are reported in versions 5.2.0, 5.3.0, 5.3.7, and 6.1.0. 3) Boundary errors in the uspchrp and utape commands can be exploited by users in the 'system' group to cause a buffer overflow and execute arbitrary code with root privileges. The vulnerabilities are reported in versions 5.2.0, 5.3.0, and 5.3.7. 4) Boundary errors in the lchangevg, ldeletepv, putlvodm, lvaryoffvg, lvgenminor, swap, swapoff, and swapon commands can be exploited by users in the 'system' group to cause a buffer overflow and execute arbitrary code with root privileges. 5) The problem is that some of the WebSM Remote Client files are installed with world-writable permissions, which can be exploited to e.g. write to the installed files. The vulnerabilities are reported in version 5.2 and 5.3. Solution: Apply interim fixes or APARs as soon as they become available: ftp://aix.software.ibm.com/aix/efixes/security/pioout_ifix.tar ftp://aix.software.ibm.com/aix/efixes/security/ps_ifix.tar ftp://aix.software.ibm.com/aix/efixes/security/uspchrp_fix.tar ftp://aix.software.ibm.com/aix/efixes/security/utape_fix.tar ftp://aix.software.ibm.com/aix/efixes/security/lvm_ifix.tar ftp://aix.software.ibm.com/aix/efixes/security/websm_linux_fix.tar ftp://aix.software.ibm.com/aix/efixes/security/swap_fix.tar -- APARs -- AIX 5.2.0: IZ10840 IZ11242 (available approximately 14/05/2008) IZ06261 IZ06260 IZ00559 IZ10828 (available approximately 07/05/2008) IY96095 Vulnerability #5 is reportedly fixed in 5.2 TL10. AIX 5.3.0: IZ10841 IZ12745 (available approximately 30/04/2008) IZ06621 IZ06620 IY98331 IY98340 IY99537 IY97257 IY96101 AIX 5.3.7: IZ10842 IZ11243 (available approximately 30/04/2008) IZ06489 IZ06488 AIX 6.1.0: IZ10844 IZ11244 (available approximately 20/02/2008) Provided and/or discovered by: The vendor credits: 1) iDefense Labs 2) Andrea "bunker" Purificato 3-5) Reported by the vendor. Changelog: 2008-01-25: Added link to iDefense Labs. 2008-02-07: Added CVE reference. 2008-03-12: Updated availability for IZ10828 in "Solution" section. Added links to IBM. 2008-05-22: Updated availability for IZ10840, IZ10841, IZ10842, IZ10843, and IZ10844 in "Solution" section. Added additional IBM link. Original Advisory: IBM: http://www14.software.ibm.com/webapp/...criptions/pqvcmjd?mode=18&ID=4078 http://www14.software.ibm.com/webapp/...criptions/pqvcmjd?mode=18&ID=4075 http://www14.software.ibm.com/webapp/...criptions/pqvcmjd?mode=18&ID=4072 http://www14.software.ibm.com/webapp/...criptions/pqvcmjd?mode=18&ID=4070 http://www14.software.ibm.com/webapp/...criptions/pqvcmjd?mode=18&ID=4068 http://www14.software.ibm.com/webapp/...criptions/pqvcmjd?mode=18&ID=4066 http://www14.software.ibm.com/webapp/...criptions/pqvcmjd?mode=18&ID=4064 http://www14.software.ibm.com/webapp/...criptions/pqvcmjd?mode=18&ID=4168 http://www14.software.ibm.com/webapp/...criptions/pqvcmjd?mode=18&ID=4169 http://aix.software.ibm.com/aix/efixes/security/pioout_advisory.asc iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=648

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

7th Oct, 2008

New advisories:	19
New vulnerabilities:	68
Updated advisories:	62

Moderately // 354 views

Debian update for php5

Moderately // 283 views

Atarone CMS Multiple Vulnerabilities

Less // 271 views

MetaGauge Directory Traversal Vulnerability

Less // 309 views

H-Sphere webshell4 Cross-Site Scripting and Request Forgery

Moderately // 293 views

CMME Information Disclosure Security Issues

Moderately // 311 views

Debian update for squid

Less // 310 views

SUSE update for mercurial

Moderately // 360 views

SUSE update for openssh

Moderately // 274 views

SUSE update for dovecot and graphicsmagic

Less // 290 views

Fedora update for mediawiki

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.