{"api_version":"1","generated_at":"2026-07-23T07:41:56+00:00","cve":"CVE-2008-4018","urls":{"html":"https://cve.report/CVE-2008-4018","api":"https://cve.report/api/cve/CVE-2008-4018.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-4018","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-4018"},"summary":{"title":"CVE-2008-4018","description":"swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors.  NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-09-11 01:13:52","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.2","severity":"","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18341","name":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18341","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM IZ18341: SYSTEM GROUP USERS CAN CREATE/MODIFY FILES REGARDLESS OF PERMS  APPLIES TO  AIX 6100-00 - United States","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/30999","name":"http://www.securityfocus.com/bid/30999","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM AIX 'swcons' Insecure File Creation Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18334","name":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18334","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"410"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44903","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44903","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18335","name":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18335","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"410"},{"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18339","name":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18339","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"410"},{"url":"http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc","name":"http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18338","name":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18338","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM IZ18338: SYSTEM GROUP USERS CAN CREATE/MODIFY FILES REGARDLESS OF PERMS  APPLIES TO  AIX 5300-07 - United States","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://secunia.com/advisories/31739","name":"http://secunia.com/advisories/31739","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM AIX \"swcons\" Command Privilege Escalation Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/2490","name":"http://www.vupen.com/english/advisories/2008/2490","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1020818","name":"http://securitytracker.com/id?1020818","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM AIX swcons Bug Lets Local Users Gain Root Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ28943","name":"http://www.ibm.com/support/docview.wss?uid=isg1IZ28943","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM IZ28943: SYSTEM GROUP USERS CAN CREATE/MODIFY FILES REGARDLESS OF PERMS APPLIES TO AIX 6100-01 - United States","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4018","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4018","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"4018","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"ibm","cpe5":"aix","cpe6":"5.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4018","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"ibm","cpe5":"aix","cpe6":"5.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4018","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"ibm","cpe5":"aix","cpe6":"6.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T10:00:42.233Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc"},{"name":"31739","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31739"},{"name":"IZ18335","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18335"},{"name":"ADV-2008-2490","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2490"},{"name":"IZ18334","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18334"},{"name":"IZ18338","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18338"},{"name":"ibm-aix-swcons-code-execution(44903)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44903"},{"name":"IZ28943","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ28943"},{"name":"IZ18339","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18339"},{"name":"30999","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/30999"},{"name":"IZ18341","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18341"},{"name":"1020818","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1020818"},{"name":"oval:org.mitre.oval:def:5932","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-09-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors.  NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc"},{"name":"31739","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31739"},{"name":"IZ18335","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18335"},{"name":"ADV-2008-2490","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2490"},{"name":"IZ18334","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18334"},{"name":"IZ18338","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18338"},{"name":"ibm-aix-swcons-code-execution(44903)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44903"},{"name":"IZ28943","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ28943"},{"name":"IZ18339","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18339"},{"name":"30999","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/30999"},{"name":"IZ18341","tags":["vendor-advisory","x_refsource_AIXAPAR"],"url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18341"},{"name":"1020818","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1020818"},{"name":"oval:org.mitre.oval:def:5932","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-4018","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors.  NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc","refsource":"CONFIRM","url":"http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc"},{"name":"31739","refsource":"SECUNIA","url":"http://secunia.com/advisories/31739"},{"name":"IZ18335","refsource":"AIXAPAR","url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18335"},{"name":"ADV-2008-2490","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2490"},{"name":"IZ18334","refsource":"AIXAPAR","url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18334"},{"name":"IZ18338","refsource":"AIXAPAR","url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18338"},{"name":"ibm-aix-swcons-code-execution(44903)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44903"},{"name":"IZ28943","refsource":"AIXAPAR","url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ28943"},{"name":"IZ18339","refsource":"AIXAPAR","url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18339"},{"name":"30999","refsource":"BID","url":"http://www.securityfocus.com/bid/30999"},{"name":"IZ18341","refsource":"AIXAPAR","url":"http://www.ibm.com/support/docview.wss?uid=isg1IZ18341"},{"name":"1020818","refsource":"SECTRACK","url":"http://securitytracker.com/id?1020818"},{"name":"oval:org.mitre.oval:def:5932","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-4018","datePublished":"2008-09-10T15:00:00.000Z","dateReserved":"2008-09-10T00:00:00.000Z","dateUpdated":"2024-08-07T10:00:42.233Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-09-11 01:13:52","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:aix:5.2:*:*:*:*:*:*:*","matchCriteriaId":"17EECCCB-D7D1-439A-9985-8FAE8B44487B"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:aix:5.3:*:*:*:*:*:*:*","matchCriteriaId":"EA8DDF4A-1C5D-4CB1-95B3-69EAE6572507"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:aix:6.1:*:*:*:*:*:*:*","matchCriteriaId":"FD518B94-9CD7-4C45-8766-578CF427B4CF"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"4018","Ordinal":"1","Title":"CVE-2008-4018","CVE":"CVE-2008-4018","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"4018","Ordinal":"1","NoteData":"swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors.  NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805.","Type":"Description","Title":"CVE-2008-4018"},{"CveYear":"2008","CveId":"4018","Ordinal":"2","NoteData":"2008-09-10","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"4018","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}