IBM AIX capture Terminal Control Sequence Buffer Overflow Vulnerability
29 Jul. 2007
Summary
The capture program is a setuid root application, installed by default under multiple versions of IBM AIX, that allows terminal sessions to be dumped to a file.
Local exploitation of a stack-based buffer overflow vulnerability in the 'capture' program included with IBM Corp.'s AIX operating system allows an attacker to execute arbitrary code with root privileges.
Vulnerable Systems:
* AIX version 5.3 with service pack 6.
* (Previous versions may also be affected).
The vulnerability exists within the code that parses terminal control sequences. A long series of control sequences will trigger an exploitable stack-based buffer overflow.
Exploitation of this vulnerability results in the execution of arbitrary code with root privileges.
The capture program is setuid root, and executable by any user with local access. The vulnerability is a stack-based buffer overflow, and is trivially exploitable.
Workaround:
Removing the setuid bit from the binary will prevent exploitation, but may make the program unusable by non-root users.
