Overview
The IBM AIX operating system contains a vulnerability in the lsfs utility that allows a local user to execute arbitrary code as root.
Description
The IBM AIX lsfs utility displays filesystem information such as mount points, permissions and volume sizes. To list this information, it executes lslv to list logical volumes and grep to parse the resulting output. Because lsfs uses relative pathnames when executing grep and lslv, a local attacker can use the PATH environment variable to redirect the calls made by lsfs to a local version of either grep or lslv. If setuid root permissions have been applied to lsfs, the local versions of grep and lslv will be executed with root privileges. |
Impact
This vulnerability allows local users to execute arbitrary code as root. |
Solution
Apply a patch from your vendor IBM has released APAR IY16909 to address this issue. For further information, please consult the "Systems Affected" section of this document. |
Clear setuid bit on lsfs
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This document was written by Jeffrey P. Lanza and is based on information provided by IBM.
Other Information
| CVE IDs: | CVE-2001-0573 |
| Severity Metric: | 21.38 |
| Date Public: | 2001-04-03 |
| Date First Published: | 2001-09-05 |
| Date Last Updated: | 2001-09-05 14:21 UTC |
| Document Revision: | 16 |