AIX Invscoutd Symbolic Link Vulnerability

Bugtraq ID:	9982
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Mar 26 2004 12:00AM
Updated:	Mar 26 2004 12:00AM
Credit:	Disclosure of this issue is credited to [email protected].
Vulnerable:	IBM AIX 5.1 L IBM AIX 4.3.3 IBM AIX 5.1
Not Vulnerable:

AIX Invscoutd Symbolic Link Vulnerability

Reportedly AIX invscoutd insecurely handles temporary files; this may allow a local attacker to destroy data on vulnerable system. This issue is due to a design error that allows a user to specify a log file that the process writes to while holding escalated privileges.

This issue may allow a malicious user to corrupt arbitrary files on the affected system, potentially leading to a system wide denial of service condition. It has also been conjectured that this issue may be leveraged to allow an attacker to gain escalated privileges, although this is unconfirmed.

AIX Invscoutd Symbolic Link Vulnerability

The following exploit has been provided:

• /data/vulnerabilities/exploits/invscoutdAIX5l_4xSymLinkExploit.pl

AIX Invscoutd Symbolic Link Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

AIX Invscoutd Symbolic Link Vulnerability

References:

• AIX Homepage (IBM)
  
• x_invscoutd_aix5l_4x.pl (Xfocus)