AIX nslookup Vulnerability

Bugtraq ID:	377
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 29 1997 12:00AM
Updated:	Oct 29 1997 12:00AM
Credit:	This vulnerability was initially released by IBM ERS as ERS-SVA-E01-1997:008.1 on 29 October 1997. Another message based on independant discovery was posted to the Bugtraq mailing list by Andreas Mueller <[email protected]> Fri, 12 F
Vulnerable:	IBM AIX 4.2 IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1.1 IBM AIX 4.1
Not Vulnerable:	IBM AIX 4.3 IBM AIX 4.2.1

AIX nslookup Vulnerability

The nslookup command which ships with AIX 4.1.* and AIX 4.2 has a vulnerability which allows local users to become root. If nslookup is installed with the s-bit all users can create and overwrite files owned by root. This works in the interactive mode, when dumping dns-records to a file (with ls -d DOMAINNAME > FILE for example). This was tested on aix 4.2.0, 4.2.1 and 4.1.1, where nslookup is installed suid-root by default.

AIX nslookup Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

AIX nslookup Vulnerability

Solution:
IBM have released the following APAR's:

AIX 4.1
---------

APAR - IX71464

AIX 4.2
----------

APAR - IX70815


IBM AIX 4.1

• IBM IX9909
  


• IBM IY02120
  

IBM AIX 4.1.1

• IBM IX9909
  


• IBM IY02120
  

IBM AIX 4.1.2

• IBM IX9909
  


• IBM IY02120
  

IBM AIX 4.1.3

• IBM IX9909
  


• IBM IY02120
  

IBM AIX 4.1.4

• IBM IX9909
  


• IBM IY02120
  

IBM AIX 4.1.5

• IBM IX9909
  


• IBM IY02120
  

IBM AIX 4.2

• IBM IX9909
  


• IBM IY02120
  

AIX nslookup Vulnerability

References:

• AIX Fix Distribution Service (IBM)
  
• IBM Support Databases (IBM)