AIX piodmgrsu Vulnerability

Bugtraq ID:	386
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 29 1997 12:00AM
Updated:	Oct 29 1997 12:00AM
Credit:	This vulnerability was released by the IBM ERS Team as ERS-SVA-E01-1997:007.1. As no public discussion resulted from this post the Discussion section of this vulnerability was taken in whole from their original posting to the Bugtraq mailing list on 29 Oct
Vulnerable:	IBM AIX 4.2 IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1.1 IBM AIX 4.1
Not Vulnerable:	IBM AIX 4.3.2 IBM AIX 4.3 IBM AIX 4.2.1

AIX piodmgrsu Vulnerability

The piodmgrsu command was first shipped in AIX 4.1 and performs various operations on the printer backend's alternate ODM database. The command passes an insecure environment to its children allowing local users to gain access to the administrative "printq" group.

AIX piodmgrsu Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

AIX piodmgrsu Vulnerability

Solution:
IBM has released the following APAR's to address this problem:

AIX 4.1
---------
APAR - IX71514

AIX 4.2
---------
APAR - IX71517

AIX piodmgrsu Vulnerability

References:

• AIX Fix Distribution Service (IBM)
  
• IBM Support Databases (IBM)