Multiple IBM AIX Unspecified LVM Utilities Symbolic Link Vulnerabilities

BID:10230

Info

Multiple IBM AIX Unspecified LVM Utilities Symbolic Link Vulnerabilities

Bugtraq ID: 10230
Class: Access Validation Error
CVE: CVE-2004-0545
Remote: No
Local: Yes
Published: Apr 22 2004 12:00AM
Updated: Jul 12 2009 04:06AM
Credit: The vendor announced this vulnerability.
Vulnerable: IBM AIX 5.2
IBM AIX 5.1
Not Vulnerable:

Discussion

Multiple IBM AIX Unspecified LVM Utilities Symbolic Link Vulnerabilities

IBM has reported that multiple undisclosed LVM utilities are prone to symbolic link attacks.

A local attacker who has interactive access to the system may exploit these vulnerabilities to corrupt files, potentially resulting in a system wide denial of service or elevated privileges.

Exploit / POC

Multiple IBM AIX Unspecified LVM Utilities Symbolic Link Vulnerabilities

There is no exploit required.

Solution / Fix

Multiple IBM AIX Unspecified LVM Utilities Symbolic Link Vulnerabilities

Solution:
IBM has released an update to their original advisory (APR-22-2004-LVM) as well as official APAR fixes; these fixes supercede the previous efixes. Further information regarding obtaining and applying APARs can be found in the referenced advisory.


IBM AIX 5.1

IBM AIX 5.2

References

Multiple IBM AIX Unspecified LVM Utilities Symbolic Link Vulnerabilities

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report