IBM AIX enq Local Format String Vulnerability

Bugtraq ID:	9254
Class:	Input Validation Error
CVE:	CVE-2003-1018
Remote:	No
Local:	Yes
Published:	Dec 19 2003 12:00AM
Updated:	Jul 12 2009 12:56AM
Credit:	This vulnerability was reported by IBM.
Vulnerable:	IBM AIX 4.3.3 IBM AIX 5.2 IBM AIX 5.1
Not Vulnerable:

IBM AIX enq Local Format String Vulnerability

IBM has released a security advisory stating that a local format string vulnerability has been discovered in enq on AIX systems. This issue is known to affect the '-P' command line switch. This may allow for a local attacker to overwrite arbitrary locations in memory, ultimately resulting in the execution of attacker-supplied code.

IBM AIX enq Local Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

IBM AIX enq Local Format String Vulnerability

Solution:
IBM has released fixes for this issue.


IBM AIX 5.1

• IBM IY46255
  http://www.ibm.com/support

IBM AIX 5.2

• IBM IY45329
  http://www.ibm.com/support

IBM AIX 4.3.3

• IBM IY45253
  http://www.ibm.com/support

IBM AIX enq Local Format String Vulnerability

References:

• AIX Homepage (IBM)
  
• MSS-OAR-E01-2003:1600.1 enq command format string vulnerability (IBM)