Vulnerability Note VU#602300

AIX "getconf" contains buffer overflow vulnerability

Overview

IBM AIX getconf contains a buffer overflow vulnerability that may lead to arbitrary code execution.

I. Description

IBM AIX contains the getconf command that provides information about system configuration. An unspecified buffer overflow condition has been identified in getconf and may lead to arbitrary code execution by local users.

II. Impact

Local, authenticated users may be able to execute arbitrary code.

III. Solution

Apply an update

IBM has issued updates to address this issue. Please see documents IY73850 and IY73814 for more information.

Systems Affected

Vendor	Status	Date Notified	Date Updated
IBM Corporation	Vulnerable	29-Sep-2005

References

http://www-1.ibm.com/support/docview.wss?uid=isg1IY73814
http://www-1.ibm.com/support/docview.wss?uid=isg1IY73850
http://secunia.com/advisories/16996/

Credit

Thanks to IBM for reporting this vulnerability.

This document was written by Ken MacInnis.

Other Information

Date Public:	2005-09-29
Date First Published:	2005-09-29
Date Last Updated:	2005-09-29
CERT Advisory:
CVE-ID(s):	CAN-2005-3060
NVD-ID(s):	CAN-2005-3060
US-CERT Technical Alerts:
Metric:	10.13
Document Revision:	4

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader