IBM AIX Diagela.SH Local Arbitrary Code Execution Vulnerability

Bugtraq ID:	15397
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Nov 11 2005 12:00AM
Updated:	Nov 11 2005 12:00AM
Credit:	This vulnerability was disclosed by the vendor.
Vulnerable:	IBM AIX 5.3 L IBM AIX 5.2.2 IBM AIX 5.2 L IBM AIX 5.1 L IBM AIX 5.3 IBM AIX 5.2 IBM AIX 5.1
Not Vulnerable:

IBM AIX Diagela.SH Local Arbitrary Code Execution Vulnerability

IBM AIX is prone to local arbitrary code execution vulnerability.

This issue affects the diagela script.

Successful exploitation can allow a local attacker to gain elevated privileges.

IBM AIX 5.1, 5.2 and 5.3 are vulnerable.

IBM AIX Diagela.SH Local Arbitrary Code Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

IBM AIX Diagela.SH Local Arbitrary Code Execution Vulnerability

Solution:
The vendor has released APARs addressing this issue. Users are advised to see the referenced vendor advisories for further information.


IBM AIX 5.1

• IBM IY78926
  http://www-1.ibm.com/support/docview.wss?uid=isg1IY78926

IBM AIX 5.2

• IBM IY78800
  http://www.ibm.com

IBM AIX 5.3

• IBM IY78801
  http://www.ibm.com

IBM AIX 5.1 L

• IBM IY78926
  http://www-1.ibm.com/support/docview.wss?uid=isg1IY78926

IBM AIX 5.2 L

• IBM IY78800
  http://www.ibm.com

IBM AIX 5.2.2

• IBM IY78800
  http://www.ibm.com

IBM AIX 5.3 L

• IBM IY78801
  http://www.ibm.com

IBM AIX Diagela.SH Local Arbitrary Code Execution Vulnerability

References:

• IY78800: SECURITY : ABSOLUTE PATH VULNERABILITIES IN DIAGELA COMMAND (IBM)
  
• IY78801: SECURITY : ABSOLUTE PATH VULNERABILITIES IN DIAGELA COMMAND (IBM)
  
• IY78926: SECURITY : ABSOLUTE PATH VULNERABILITIES IN DIAGELA COMMAND (IBM)