Overview
sysback, shipped with AIX systems, allows local users to gain root access because of a failure to use a fully qualified path for a call to hostname.
Description
sysback includes a call to hostname but does not include a full path specification. Because sysback is set uid root, intruders can put a malicious hostname in the path before the "real" hostname, and thereby execute any commands with root privileges. |
Impact
Local users can execute arbitrary commands and programs with root privileges. |
Solution
Update to sysback.rte 4.2.1.13 as described in the IBM vendor statement. |
Remove setuid root from sysback in environments that permit it (where such a change would not be detrimental to operations). |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Our thanks to Kiki Lee for reporting this vulnerability.
This document was written by Shawn V Hernan.
Other Information
| CVE IDs: | None |
| Severity Metric: | 1.35 |
| Date Public: | 2000-12-10 |
| Date First Published: | 2000-12-12 |
| Date Last Updated: | 2000-12-12 23:11 UTC |
| Document Revision: | 6 |