Vulnerability Note VU#602300

AIX "getconf" contains buffer overflow vulnerability

Overview

IBM AIX getconf contains a buffer overflow vulnerability that may lead to arbitrary code execution.

I. Description

IBM AIX contains the getconf command that provides information about system configuration. An unspecified buffer overflow condition has been identified in getconf and may lead to arbitrary code execution by local users.

II. Impact

Local, authenticated users may be able to execute arbitrary code.

III. Solution

Apply an update

IBM has issued updates to address this issue. Please see documents IY73850 and IY73814 for more information.

Systems Affected

Vendor	Status	Date Updated
IBM Corporation	Vulnerable	29-Sep-2005

References

http://www-1.ibm.com/support/docview.wss?uid=isg1IY73814
http://www-1.ibm.com/support/docview.wss?uid=isg1IY73850
http://secunia.com/advisories/16996/

Credit

Thanks to IBM for reporting this vulnerability.

This document was written by Ken MacInnis.

Other Information

Date Public	09/29/2005
Date First Published	09/29/2005 10:49:50 AM
Date Last Updated	09/29/2005
CERT Advisory
CVE Name	CAN-2005-3060
Metric	10.13
Document Revision	4

If you have feedback, comments, or additional information about this vulnerability, please send us email.