CVE

Id
29162  
CVE No.
CVE-2007-5805  
Status
Candidate  
Description
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create an arbitrary file, and enable world writability of this file, via a symlink attack involving use of the file"s name as the argument. NOTE: this issue is due to an incomplete fix for CVE-2007-5804.  
Phase
Assigned (20071105)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
305940 29162 CVE-2007-5805 IDEFENSE:20071030 IBM AIX swcons Local Arbitrary File Access Vulnerability  View
305941 29162 CVE-2007-5805 URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=611  View
305942 29162 CVE-2007-5805 CONFIRM:ftp://aix.software.ibm.com/aix/efixes/security/cfgcon_ifix.tar  View
305943 29162 CVE-2007-5805 CONFIRM:http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX53&path=%2F200710%2FSECURITY%2F20071030%2Fdatafile100405  View
305944 29162 CVE-2007-5805 AIXAPAR:IZ03055  View
305945 29162 CVE-2007-5805 URL:http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03055  View
305946 29162 CVE-2007-5805 AIXAPAR:IZ03061  View
305947 29162 CVE-2007-5805 URL:http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03061  View
305948 29162 CVE-2007-5805 BID:26258  View
305949 29162 CVE-2007-5805 URL:http://www.securityfocus.com/bid/26258  View
305950 29162 CVE-2007-5805 SECUNIA:27437  View
305951 29162 CVE-2007-5805 URL:http://secunia.com/advisories/27437  View
305952 29162 CVE-2007-5805 XF:aix-swcons-insecure-permissions(38154)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
57600 JVNDB-2007-006292 SSReader の Ultra Star Reader ActiveX コントロールにおけるバッファオーバーフローの脆弱性 SSReader の Ultra Star Reader ActiveX コントロールの register 関数には、バッファオーバーフローの脆弱性が存在します。 CVE-2007-5807 29162 6.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-006292.html  View