IBM AIX rm_mlcache_file race condition file overwrite
| aix-rm-mlcache-file-overwrite (25848) |  Medium Risk |
Description:
IBM AIX could allow a local attacker to overwrite arbitrary files on the system, caused by a race condition in the rm_mlcache_file command. An attacker could use this vulnerability to gain elevated privileges on the system.
Consequences:
File Manipulation
Remedy:
For AIX 5.3.0:
Apply APAR IY82357, available from the IBM Support and Downloads Web site. See References.
--OR--
Apply the temporary patch for this vulnerability (rm_mlcache_file_ifix.tar.Z), available from the IBM FTP site. See References.
References:
- IBM FTP site: README.
- IBM FTP site: Index of ftp://aix.software.ibm.com/aix/efixes/security/.
- IBM Support & downloads: IY82357: SECURITY ISSUE IN BOS.RTE.INSTALL.
- NSFOCUS Security Advisory (SA2006-03): IBM AIX rm_mlcache_file Local Race Condition Vulnerability.
- BID-17576: IBM AIX RM_MLCache_File Insecure Temporary File Creation Vulnerability
- CVE-2006-1247: rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- SA19656: IBM AIX rm_mlcache_file Arbitrary File Overwrite
- SECTRACK ID: 1015952: IBM AIX rm_mlcache_file Command May Let Local Users Gain Elevated Privileges
- VUPEN/ADV-2006-1389: IBM AIX rm_mlcache_file Command Unspecified Local File Overwrite Issue
Platforms Affected:
- IBM AIX 5.1
- IBM AIX 5.2
- IBM AIX 5.3
Reported:
Apr 17, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net