Infod, (also known as Info Explorer daemon) an application which provides users with AIX's documentation, was found to be vulnerable to a security attack allowing unprivileged users to gain root access.
Infod listens for documentation requests via a network socket, information obtained via this socket does not pass any validation mechanism, allowing any user to present himself as root. This allows access to root based functions such as shell.
To exploit 'infod' a malicious user send the UID and the GID of the root user (UID and GID 0) instead of those he has, making infod spawn a privileged X session with root permissions. Then all he has to do is configure his printing device to '/bin/sh' which causes the execution of a shell whenever the malicious user desires.
