IBM AIX Acctctl Command Local Arbitrary Command Execution Vulnerability

Bugtraq ID:	20206
Class:	Unknown
CVE:	CVE-2006-5010
Remote:	No
Local:	Yes
Published:	Sep 25 2006 12:00AM
Updated:	Feb 20 2007 09:26PM
Credit:	The vendor disclosed this issue.
Vulnerable:	IBM AIX 5.3
Not Vulnerable:

IBM AIX Acctctl Command Local Arbitrary Command Execution Vulnerability

IBM AIX is prone to an arbitrary-command-execution vulnerability.

An attacker in the 'adm' group can exploit this vulnerability to execute arbitrary commands with superuser privileges. A successful exploit would lead to a complete compromise of affected computers.

AIX version 5.3 is vulnerable to this issue.

IBM AIX Acctctl Command Local Arbitrary Command Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

IBM AIX Acctctl Command Local Arbitrary Command Execution Vulnerability

Solution:
The vendor has released an interim fix to address this issue. Please see the references for more information.


IBM AIX 5.3

• IBM acctctl_fix.tar.Z
  ftp://aix.software.ibm.com/aix/efixes/security/acctctl_ifix.tar.Z


• IBM IY88681 acctctl
  http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

IBM AIX Acctctl Command Local Arbitrary Command Execution Vulnerability

References:

• IBM AIX Home Page (IBM)