AIX ttylock(3) Buffer Overflow Vulnerability

Bugtraq ID:	446
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 06 1998 12:00AM
Updated:	Aug 06 1998 12:00AM
Credit:	This vulnerability was published to the IBM APAR Database on August 6, 1998. The SecurityFocus Database entry for this problem is based wholly off that information.
Vulnerable:	IBM AIX 4.3
Not Vulnerable:	IBM AIX 4.2.1 IBM AIX 4.2 IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1.1 IBM AIX 4.1

AIX ttylock(3) Buffer Overflow Vulnerability

Under certain versions of AIX, the system call ttylock(3) contains a buffer overflow. This overflow if exploited can cause any program which uses libctty libraries to coredump. This poses a potential security problem if the program which dumps core dumps with improper permissions.

AIX ttylock(3) Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

AIX ttylock(3) Buffer Overflow Vulnerability

Solution:
IBM has released the following APAR'S to address this problem:

AIX 4.3
---------
APAR # IX81077

AIX ttylock(3) Buffer Overflow Vulnerability

References:

• AIX Fix Distribution Service (IBM)
  
• IBM Support Databases (IBM)