NVD

Id
49910  
Name
CVE-2009-2669  
Description
A certain debugging component in IBM AIX 5.3 and 6.1 does not properly handle the (1) _LIB_INIT_DBG and (2) _LIB_INIT_DBG_FILE environment variables, which allows local users to gain privileges by leveraging a setuid-root program to create an arbitrary root-owned file with world-writable permissions, related to libC.a (aka the XL C++ runtime library) in AIX 5.3 and libc.a in AIX 6.1.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-08-05  
Modified Date
2009-08-12  
Seq
2009-2669  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
252323 49910 CVE-2009-2669 http://aix.software.ibm.com/aix/efixes/security/libC_advisory.asc  View
252324 49910 CVE-2009-2669 20090804 IBM AIX libC _LIB_INIT_DBG Arbitrary File Creation Vulnerability  View
252325 49910 CVE-2009-2669 IZ56203  View
252326 49910 CVE-2009-2669 IZ56204  View
252327 49910 CVE-2009-2669 IZ56205  View
252328 49910 CVE-2009-2669 IZ56206  View
252329 49910 CVE-2009-2669 35934  View
252330 49910 CVE-2009-2669 ADV-2009-2151  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40985 JVNDB-2009-001991 IBM AIX の デバッグコンポーネントにおける権限昇格の脆弱性 IBM AIX の デバッグコンポーネントには、環境変数 _LIB_INIT_DBG および _LIB_INIT_DBG_FILE の取り扱いに不備があるため、setuid-root プログラムですべてのユーザに書き込み権限のある root 所有のファイルを作成することにより、権限を取得可能な脆弱性が存在します。 CVE-2009-2669 40100 CVE-2009-2669 49910 7.2 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001991.html 2009-08-04 2009-09-10 View