AIX infod Vulnerability
BID:370
Info
AIX infod Vulnerability
| Bugtraq ID: | 370 |
| Class: | Origin Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 12 1998 12:00AM |
| Updated: | Nov 12 1998 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Repent Security Inc. (RSI) on November 12, 1998. |
| Vulnerable: |
IBM AIX 4.3 IBM AIX 4.2.1 IBM AIX 4.2 IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1.1 IBM AIX 4.1 IBM AIX 3.2.5 |
| Not Vulnerable: | |
Discussion
AIX infod Vulnerability
Certain versions of AIX ship with an Information Daemon, infod. This program is designed to provide information about the OS and installed ancilliary programs. The daemon which runs as root, does not check credentials which are passed to it. This allows users to pass requests with arbitrary UID's. If a user passes infod a request as root, they can goto the default options menu and change the printer command line to an alternate binary such as /bin/sh that gives privileges to the account the session was spawned under.
Certain versions of AIX ship with an Information Daemon, infod. This program is designed to provide information about the OS and installed ancilliary programs. The daemon which runs as root, does not check credentials which are passed to it. This allows users to pass requests with arbitrary UID's. If a user passes infod a request as root, they can goto the default options menu and change the printer command line to an alternate binary such as /bin/sh that gives privileges to the account the session was spawned under.
Exploit / POC
Solution / Fix
AIX infod Vulnerability
Solution:
IBM has made the following APAR's available:
AIX 3.2.x: upgrade to version 4
AIX 4.1.x: IX84640
AIX 4.2.x: IX84641
AIX 4.3.x: IX84642
The RSI Advisory offered the following temporary solution:
Until the fixes can be applied, the infod daemon should be disabled. Run the following commands as root:
# stopsrc -s infod
# rmitab infod
# chown root.system /usr/lpp/info/bin/infod
# chmod 0 /usr/lpp/info/bin/infod
Solution:
IBM has made the following APAR's available:
AIX 3.2.x: upgrade to version 4
AIX 4.1.x: IX84640
AIX 4.2.x: IX84641
AIX 4.3.x: IX84642
The RSI Advisory offered the following temporary solution:
Until the fixes can be applied, the infod daemon should be disabled. Run the following commands as root:
# stopsrc -s infod
# rmitab infod
# chown root.system /usr/lpp/info/bin/infod
# chmod 0 /usr/lpp/info/bin/infod