FKIE_CVE-2008-4018

Vulnerability from fkie_nvd - Published: 2008-09-11 01:13 - Updated: 2026-06-16 22:57
Severity
Summary
swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors. NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805.
References
cve@mitre.orghttp://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc
cve@mitre.orghttp://secunia.com/advisories/31739
cve@mitre.orghttp://securitytracker.com/id?1020818
cve@mitre.orghttp://www.ibm.com/support/docview.wss?uid=isg1IZ18334
cve@mitre.orghttp://www.ibm.com/support/docview.wss?uid=isg1IZ18335
cve@mitre.orghttp://www.ibm.com/support/docview.wss?uid=isg1IZ18338
cve@mitre.orghttp://www.ibm.com/support/docview.wss?uid=isg1IZ18339
cve@mitre.orghttp://www.ibm.com/support/docview.wss?uid=isg1IZ18341
cve@mitre.orghttp://www.ibm.com/support/docview.wss?uid=isg1IZ28943
cve@mitre.orghttp://www.securityfocus.com/bid/30999
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/2490
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/44903
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932
af854a3a-2127-422b-91ae-364da2661108http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/31739
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1020818
af854a3a-2127-422b-91ae-364da2661108http://www.ibm.com/support/docview.wss?uid=isg1IZ18334
af854a3a-2127-422b-91ae-364da2661108http://www.ibm.com/support/docview.wss?uid=isg1IZ18335
af854a3a-2127-422b-91ae-364da2661108http://www.ibm.com/support/docview.wss?uid=isg1IZ18338
af854a3a-2127-422b-91ae-364da2661108http://www.ibm.com/support/docview.wss?uid=isg1IZ18339
af854a3a-2127-422b-91ae-364da2661108http://www.ibm.com/support/docview.wss?uid=isg1IZ18341
af854a3a-2127-422b-91ae-364da2661108http://www.ibm.com/support/docview.wss?uid=isg1IZ28943
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/30999
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/2490
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/44903
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932
Impacted products
Vendor Product Version
ibm aix 5.2
ibm aix 5.3
ibm aix 6.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:aix:5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "17EECCCB-D7D1-439A-9985-8FAE8B44487B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:aix:5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA8DDF4A-1C5D-4CB1-95B3-69EAE6572507",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:aix:6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD518B94-9CD7-4C45-8766-578CF427B4CF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors.  NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805."
    },
    {
      "lang": "es",
      "value": "swcons en bos.rte.console en IBM AIX v5.2.0 a v 6.1.1, permite a usuarios locales en el grupo de \"sistema\" crear o sobreescribir archivos de su elecci\u00f3n y establecer permisos d\u00e9biles y asignar la propiedad del archivo a administradores a trav\u00e9s de vectores no especificados. NOTA: esto puede ser aprovechado para obtener privielegios. NOTA: esta vulnerabilidad existe por un fallo no corregido en CVE-2007-5805."
    }
  ],
  "id": "CVE-2008-4018",
  "lastModified": "2026-06-16T22:57:00.180",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-09-11T01:13:52.867",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/31739"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1020818"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18334"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18335"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18338"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18339"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18341"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ28943"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/30999"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/2490"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44903"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/31739"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1020818"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18334"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18335"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18338"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18339"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ18341"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ28943"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/30999"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/2490"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44903"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.