AIX dpsexec Vulnerability

Bugtraq ID:	358
Class:	Access Validation Error
CVE:	CVE-1999-1552
Remote:	No
Local:	Yes
Published:	Jul 20 1994 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	This bug was posted to tbe Bugtraq mailing list by Sam Hartman ([email protected]) Wed, 20 July 1994.
Vulnerable:	IBM AIX 3.2.5 IBM AIX 3.2.4 IBM AIX 3.2 IBM AIX 3.1
Not Vulnerable:

AIX dpsexec Vulnerability

AIX versions previous and up to 3.2.5 (and possibly later) ship with a DPS Server. When run under XDM (a login utility under certian X-Windows versions) this server assumes root privileges. Due to this, and no proper UID checking, users can write to any file on the system therefore gaining root privileges.

AIX dpsexec Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

AIX dpsexec Vulnerability

Solution:
Disable the DPS server (/usr/lpp/DPS/bin/dpsexec). This server is actually by default already turned off. If you have have enabled it because you require it we suggest you consider an alternative as there is currently no known fix to this problem.

AIX dpsexec Vulnerability

References:

• AIX Fix Distribution Service (IBM)
  
• IBM Support Databases (IBM)