CERTA-2006-AVI-415

Vulnerability from certfr_avis - Published: 2006-10-03 - Updated: 2006-10-03

None

Description

De multiples vulnérabilités ont été identifiées dans le système d'exploitation IBM AIX. Elles permettraient à un utilisateur malveillant local au système vulnérable d'élever ses privilèges à ceux de l'administrateur (root), voire de modifier des données ou de provoquer un déni de service. Parmi ces vulnérabilités :

  • la commande mkvg ne faisant pas appel aux chemins absolus vers certaines fonctions ;
  • une erreur non précisée dans named8, un serveur de noms de domaines DNS ;
  • une mauvaise manipulation des fichiers par la commande rdist, servant à distribuer des copies de fichiers à plusieurs hôtes ;
  • une mauvaise manipulation de la base de données par l'utilitaire Inventory Scout, permettant de lister entre autres les éléments matériels du système ;
  • une erreur non précisée dans la commande utape associée au mode Diagnostics ;
  • une mauvaise manipulation des paramètres fournis à la commande cfgmgr, pouvant provoquer un débordement de mémoire ;
  • une erreur non précisée dans xlock, commande qui permet de verrouiller l'écran, et pouvant être exploitée pour provoquer un débordement de tampon et exécuter des commandes avec les droits de l'administrateur.

Solution

Se référer aux différents bulletins de sécurité d'IBM pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM AIX IBM AIX 5.3.0
IBM AIX IBM AIX 5.2.0
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM AIX 5.3.0",
      "product": {
        "name": "AIX",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM AIX 5.2.0",
      "product": {
        "name": "AIX",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le syst\u00e8me\nd\u0027exploitation IBM AIX. Elles permettraient \u00e0 un utilisateur malveillant\nlocal au syst\u00e8me vuln\u00e9rable d\u0027\u00e9lever ses privil\u00e8ges \u00e0 ceux de\nl\u0027administrateur (root), voire de modifier des donn\u00e9es ou de provoquer\nun d\u00e9ni de service. Parmi ces vuln\u00e9rabilit\u00e9s :\n\n-   la commande mkvg ne faisant pas appel aux chemins absolus vers\n    certaines fonctions ;\n-   une erreur non pr\u00e9cis\u00e9e dans named8, un serveur de noms de domaines\n    DNS ;\n-   une mauvaise manipulation des fichiers par la commande rdist,\n    servant \u00e0 distribuer des copies de fichiers \u00e0 plusieurs h\u00f4tes ;\n-   une mauvaise manipulation de la base de donn\u00e9es par l\u0027utilitaire\n    Inventory Scout, permettant de lister entre autres les \u00e9l\u00e9ments\n    mat\u00e9riels du syst\u00e8me ;\n-   une erreur non pr\u00e9cis\u00e9e dans la commande utape associ\u00e9e au mode\n    Diagnostics ;\n-   une mauvaise manipulation des param\u00e8tres fournis \u00e0 la commande\n    cfgmgr, pouvant provoquer un d\u00e9bordement de m\u00e9moire ;\n-   une erreur non pr\u00e9cis\u00e9e dans xlock, commande qui permet de\n    verrouiller l\u0027\u00e9cran, et pouvant \u00eatre exploit\u00e9e pour provoquer un\n    d\u00e9bordement de tampon et ex\u00e9cuter des commandes avec les droits de\n    l\u0027administrateur.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux diff\u00e9rents bulletins de s\u00e9curit\u00e9 d\u0027IBM pour l\u0027obtention\ndes correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-5003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5003"
    },
    {
      "name": "CVE-2006-5005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5005"
    },
    {
      "name": "CVE-2006-5006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5006"
    },
    {
      "name": "CVE-2006-5009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5009"
    },
    {
      "name": "CVE-2006-4416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4416"
    },
    {
      "name": "CVE-2006-5004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5004"
    },
    {
      "name": "CVE-2006-5002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5002"
    },
    {
      "name": "CVE-2006-5007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5007"
    },
    {
      "name": "CVE-2006-5008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5008"
    }
  ],
  "initial_release_date": "2006-10-03T00:00:00",
  "last_revision_date": "2006-10-03T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88722 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88722"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88688 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88688"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88642 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88642"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88566 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88566"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88699 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88699"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY89434 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY89434"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88615 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88615"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88735 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88735"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88687 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88687"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88818 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88818"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY89512 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY89512"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88641 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88641"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88565 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88565"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY87943 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY87943"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88820 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88820"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY88614 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY88614"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM IY87894 du 14 septembre 2006 :",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=isg1IY87894"
    }
  ],
  "reference": "CERTA-2006-AVI-415",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-10-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM AIX",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 IBM AIX",
      "url": null
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.