IBM AIX Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence

IBM AIX Multiple Vulnerabilities
Secunia Advisory:	SA30349	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2008-05-22
Last Update:	2008-06-04
Popularity:	3,167 views

Critical:	Less critical
Impact:	Privilege escalation DoS
Where:	Local system
Solution Status:	Vendor Patch

OS:	AIX 5.x AIX 6.x

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2008-2513 CVE-2008-2514 CVE-2008-2515

Description: Some vulnerabilities have been reported in IBM AIX, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges. 1) A boundary error within the AIX kernel can be exploited to cause a buffer overflow and execute arbitrary code with kernel privileges. 2) A boundary error within the setuid root errpt command can be exploited to cause a buffer overflow and execute arbitrary code with root privileges. 3) An error within the setuid root iostat command when handling certain environment variables can be exploited to execute arbitrary code with root privileges. The vulnerabilities are reported in versions 5.2, 5.3, and 6.1. Solution: Apply fixes or APARs as soon as they become available. http://aix.software.ibm.com/aix/efixes/security/unix_fix.tar ftp://aix.software.ibm.com/aix/efixes/security/unix_fix.tar http://aix.software.ibm.com/aix/efixes/security/errpt_fix.tar ftp://aix.software.ibm.com/aix/efixes/security/errpt_fix.tar http://aix.software.ibm.com/aix/efixes/security/iostat_fix.tar ftp://aix.software.ibm.com/aix/efixes/security/iostat_fix.tar -- APARs -- AIX 5.2.0: IZ19911 IZ19905 IZ20635 AIX 5.3.0: IZ22368 (available approximately 20/06/2008) IZ22346 (available approximately 20/06/2008) IZ22350 (available approximately 20/06/2008) AIX 5.3.7: IZ22369 (available approximately 20/06/2008) IZ22347 (available approximately 20/06/2008) IZ22351 (available approximately 20/06/2008) AIX 5.3.8: IZ21481 (available approximately 20/06/2008) IZ21494 (available approximately 20/06/2008) IZ21506 (available approximately 20/06/2008) AIX 6.1.0: IZ22370 (available approximately 20/06/2008) IZ22348 (available approximately 20/06/2008) IZ22349 (available approximately 20/06/2008) Provided and/or discovered by: Reported by the vendor. Changelog: 2008-06-04: Added CVE reference. Original Advisory: http://aix.software.ibm.com/aix/efixes/security/unix_advisory.asc http://aix.software.ibm.com/aix/efixes/security/errpt_advisory.asc http://aix.software.ibm.com/aix/efixes/security/iostat_advisory.asc

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

Today

New advisories:	15
New vulnerabilities:	83
Updated advisories:	41

Moderately // 154 views

ScriptsEz Easy Image Downloader "id" File Disclosure Vulnerability

Moderately // 165 views

Built2go Real Estate Listings "event_id" SQL Injection

Highly // 248 views

Sun Java System Web Proxy Server FTP Subsystem Buffer Overflow

Moderately // 175 views

Red Hat update for cups

Highly // 190 views

DFF PHP Framework API "DFF_config[dir_incl ude]" File Inclusion Vulnerabilities

Not // 209 views

FUJITSU Interstage Products Apache Tomcat Security Bypass

Moderately // 367 views

Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

Moderately // 219 views

Fedora update for condor

Moderately // 451 views

CUPS Multiple Vulnerabilities

Not // 254 views

Gentoo Portage Insecure Python Module Search Path Security Issue

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.