AIX enq Buffer Overflow Vulnerability
BID:2034
Info
AIX enq Buffer Overflow Vulnerability
| Bugtraq ID: | 2034 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 01 2000 12:00AM |
| Updated: | Dec 01 2000 12:00AM |
| Credit: | This vulnerability was announced by Esa Etelavuori <[email protected]> on December 1, 2000. |
| Vulnerable: |
IBM AIX 4.3.3 IBM AIX 4.3.2 IBM AIX 4.3.1 IBM AIX 4.3 IBM AIX 4.2.1 IBM AIX 4.2 |
| Not Vulnerable: | |
Discussion
AIX enq Buffer Overflow Vulnerability
AIX is a variant of the UNIX Operating System, distributed by IBM. A problem exists that may allow elevation of user priviledges.
The problem occurs in the enq program. It is reported that an overflow exists in the command line argument parsing, which could lead to the overwriting of variables on the stack. This creates the potential for a malicious user to execute arbitrary code, and possibly gain administrative access.
AIX is a variant of the UNIX Operating System, distributed by IBM. A problem exists that may allow elevation of user priviledges.
The problem occurs in the enq program. It is reported that an overflow exists in the command line argument parsing, which could lead to the overwriting of variables on the stack. This creates the potential for a malicious user to execute arbitrary code, and possibly gain administrative access.
Exploit / POC
AIX enq Buffer Overflow Vulnerability
An exploit is available. See Reference section for details.
An additional exploit (ex_enq_aix4x.sh) has been made available.
An exploit is available. See Reference section for details.
An additional exploit (ex_enq_aix4x.sh) has been made available.
Solution / Fix
AIX enq Buffer Overflow Vulnerability
Solution:
Upgrades available:
IBM AIX 4.2
IBM AIX 4.2.1
IBM AIX 4.3
IBM AIX 4.3.1
IBM AIX 4.3.2
IBM AIX 4.3.3
Solution:
Upgrades available:
IBM AIX 4.2
IBM AIX 4.2.1
IBM AIX 4.3
IBM AIX 4.3.1
IBM AIX 4.3.2
IBM AIX 4.3.3
References
AIX enq Buffer Overflow Vulnerability
References:
References:
- /usr/bin/enq and /usr/bin/X11/aixterm exploit in AIX (choi sungwoon