>> IBM AIX "swcons" Insecure Permission Privilege Escalation Vulnerability
Title : IBM AIX "swcons" Insecure Permission Privilege Escalation Vulnerability VUPEN ID : VUPEN/ADV-2008-2490 CVE ID : CVE-2008-4018 CWE ID : CWE-264
Rated as : Moderate Risk
Remotely Exploitable : No Locally Exploitable : Yes Release Date : 2008-09-04
Technical Description
A vulnerability has been identified in IBM AIX, which could be exploited by local attackers to gain elevated privileges. This issue is caused by insecure permissions being set on the "/usr/sbin/swcons" utility, which could allow a malicious user (member of the "system" group) to execute arbitrary code by creating files owned by root that have insecure permissions.
IBM AIX 5.2.0 - Apply APAR IZ18335
IBM AIX 5.3.0 - Apply APAR IZ18339 (10/29/2008)
IBM AIX 5.3.7 - Apply APAR IZ18338 (10/29/2008)
IBM AIX 5.3.8 - Apply APAR IZ18334 (10/29/2008)
IBM AIX 6.1.0 - Apply APAR IZ18341 (11/19/2008)
IBM AIX 6.1.1 - Apply APAR IZ28943 (11/19/2008) References
