IBM AIX console commands symlink attack

aix-console-commands-symlink (16008) The risk level is classified as MediumMedium Risk

Description:

IBM AIX is vulnerable to a symlink attack. AIX console commands included in the bos.rte.console and bos.rte.serv_aid filesets create insecure files. A local attacker could create a symbolic link for one of these files to an arbitrary file on the system, which could allow the attacker to overwrite files or cause a denial of service.


Consequences:

File Manipulation

Remedy:

For IBM AIX 5.1:
Apply the APAR IY55790 patch, as listed in the IBM Security Advisory: Thu Apr 22 15:17:51 CDT 2004. See References.

For IBM AIX 5.2:
Apply the APAR IY55789 patch, as listed in the IBM Security Advisory: Thu Apr 22 15:17:51 CDT 2004. See References.

—OR—

Apply the appropriate Efixe for your system, as listed in the IBM Security Advisory: Thu Apr 22 15:17:51 CDT 2004. See References.

References:

  • IBM Security Advisory: Thu Apr 22 15:17:51 CDT 2004: symlink vulnerabilities in console commands..
  • BID-10231: Multiple IBM AIX Unspecified Console Commands Symbolic Link Vulnerabilities
  • CVE-2004-2634: The (1) bos.rte.serv_aid or (2) bos.rte.console filesets in IBM AIX 5.1 and 5.2 allow local users to overwrite arbitrary files via a symlink attack on temporary files via unknown attack vectors.
  • OSVDB ID: 5711: AIX bos.rte.console Symlink Arbitrary File Overwrite
  • OSVDB ID: 5712: AIX bos.rte.serv_aid Commands Insecure File Creation
  • SA11496: AIX Console Commands Insecure File Creation Vulnerabilities
  • SECTRACK ID: 1009975: IBM AIX Console Command Temporary Files May Let Local Users Gain Elevated Privileges

Platforms Affected:

  • IBM AIX 5.1
  • IBM AIX 5.2

Reported:

Apr 22, 2004

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page