NVD

Id
57856  
Name
CVE-2007-5805  
Description
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create an arbitrary file, and enable world writability of this file, via a symlink attack involving use of the file"s name as the argument. NOTE: this issue is due to an incomplete fix for CVE-2007-5804.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2007-11-05  
Modified Date
2008-09-10  
Seq
2007-5805  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
296123 57856 CVE-2007-5805 ftp://aix.software.ibm.com/aix/efixes/security/cfgcon_ifix.tar  View
296124 57856 CVE-2007-5805 20071030 IBM AIX swcons Local Arbitrary File Access Vulnerability  View
296125 57856 CVE-2007-5805 IZ03055  View
296126 57856 CVE-2007-5805 IZ03061  View
296127 57856 CVE-2007-5805 26258  View
296128 57856 CVE-2007-5805 http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX53&path=%2F200710%2FSECURITY%2F20071030%2Fdatafile100405  View
296129 57856 CVE-2007-5805 aix-swcons-insecure-permissions(38154)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
52230 JVNDB-2007-000920 IBM AIX の swcons コマンドにおける任意のファイルを作成される脆弱性 IBM AIX の cfgcon には、swcons コマンドの -p オプションにおいて、引数の取り扱いに不備が存在するために、システムグループの権限で任意のファイルを作成される脆弱性が存在します。 CVE-2007-5805 29160 CVE-2007-5805 57856 6.9 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000920.html 2007-08-14 2007-11-09 View