search menu icon-carat-right cmu-wordmark

CERT Coordination Center

IBM AIX nslookup fails to drop root privileges

Vulnerability Note VU#18419

Original Release Date: 2001-09-26 | Last Revised: 2001-09-27


The nslookup command fails to drop privileges, allowing local attackers to gain root privileges.


The nslookup program fails to drop the privileges it gains from being setuid. This access appears to be needed to read the "/etc/resolv.conf" file. This problem was described in IBM ERS advisory ERS-SVA-E01-1997:008.1.


Intruders with access to a local user account may be able to gain root privileges.


Apply a Patch

For AIX version 4.1, system administrators should apply APAR #IX71464. For AIX version 4.2, system administrators should apply APAR #IX70815.

Disable the setuid bit on nslookup

You can prevent this vulnerability from being exploited by removing the setuid bit from the nslookup program. You can do this by executing the following command as root:

chmod 555 /usr/bin/nslookup

Vendor Information


IBM Affected

Updated:  September 26, 2001



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A



This document was written by Cory F. Cohen.

Other Information

CVE IDs: CVE-1999-0093
Severity Metric: 2.76
Date Public: 1997-10-29
Date First Published: 2001-09-26
Date Last Updated: 2001-09-27 19:00 UTC
Document Revision: 10

Sponsored by CISA.