IBM AIX PAGINIT Local Format String Vulnerability

Bugtraq ID:	13911
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 09 2005 12:00AM
Updated:	Jun 09 2005 12:00AM
Credit:	Discovery is credited to Computer Academic Underground.
Vulnerable:	IBM AIX 5.3
Not Vulnerable:

IBM AIX PAGINIT Local Format String Vulnerability

A local format string vulnerability affects IBM AIX paginit.

The problem presents itself when the affected application attempts to process a malicious argument.

An attacker may leverage this issue to execute arbitrary code with superuser privileges, ultimately facilitating privilege escalation.

IBM AIX 5.3 is reportedly vulnerable, however, other versions may be affected as well.

IBM AIX PAGINIT Local Format String Vulnerability

The following proof of concept is available:
/usr/bin/paginit `perl -e 'print "%x" x 1024;'`

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

IBM AIX PAGINIT Local Format String Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

IBM AIX PAGINIT Local Format String Vulnerability

References:

• AIX Homepage (IBM)
  
• IBM AIX paginit Command-line Argument Format String (Computer Academic Underground)