|
|
|
|
| |
Credit:
The information has been provided by iDefense.
The original article can be found at:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=569
|
| |
Vulnerable Systems:
* AIX version 5.3 with service pack 6.
* (Previous versions may also be affected).
Exploitation of this vulnerability results in the execution of arbitrary code with root privileges.
The pioout program is setuid root, and executable by any user with local access. To exploit the vulnerability, all an attacker has to do is create a shared library that executes a shell.
Workaround:
Removing the setuid bit from the binary will prevent exploitation, but may make the program unusable by non-root users.
Vendor Status:
IBM Corp. has addressed this vulnerability by releasing interim fixes. More information can be found via the Bulletins tab of IBM's Subscription Service for UNIX and Linux servers.
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=1
CVE Information:
CVE-2007-4003
Disclosure Timeline:
* 06/05/2007 - Initial vendor notification
* 06/08/2007 - Initial vendor response
* 07/26/2007 - Coordinated public disclosure
|
|
|
|
|
