NVD

Id
57855  
Name
CVE-2007-5804  
Description
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create or overwrite an arbitrary file, and enable world writability of this file, by using the file"s name as the argument.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2007-11-05  
Modified Date
2008-09-10  
Seq
2007-5804  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
296116 57855 CVE-2007-5804 ftp://aix.software.ibm.com/aix/efixes/security/cfgcon_ifix.tar  View
296117 57855 CVE-2007-5804 20071030 IBM AIX swcons Local Arbitrary File Access Vulnerability  View
296118 57855 CVE-2007-5804 IZ03055  View
296119 57855 CVE-2007-5804 IZ03061  View
296120 57855 CVE-2007-5804 26258  View
296121 57855 CVE-2007-5804 http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX53&path=%2F200710%2FSECURITY%2F20071030%2Fdatafile100405  View
296122 57855 CVE-2007-5804 aix-swcons-insecure-permissions(38154)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
52229 JVNDB-2007-000919 IBM AIX の swcons コマンドにおける任意を操作される脆弱性 IBM AIX の cfgcon には swcons コマンドの -p オプションにおいて、引数の取り扱いに不備があり、システムグループの権限で任意のファイルを上書きされたり、作成されたりする脆弱性が存在します。 CVE-2007-5804 29159 CVE-2007-5804 57855 6.9 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000919.html 2007-08-14 2007-11-09 View