IBM AIX LDAP Authentication Flaw Lets Local Users Gain Elevated Privileges

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1027021

SecurityTracker URL: http://securitytracker.com/id/1027021

CVE Reference: CVE-2012-0745 (Links to External Site)

Date: May 4 2012

Impact: User access via local system

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 5.3, 6.1, and 7.1

Description: A vulnerability was reported in IBM AIX. A local user can obtain elevated privileges on the target system.

A local user can exploit a flaw in the getpwnam() function to gain elevated privileges.

Systems configured with customer extended LDAP user filtering are affected.

Impact: A local user can obtain elevated privileges on the target system.

Solution: The vendor has issued a fix.

5.3.12: APAR IV18638
6.1.5: APAR IV19097
6.1.6: APAR IV19077
6.1.7: APAR IV18637
7.1.0: APAR IV19098
7.1.1: APAR IV18464

The vendor's advisory is available at:

http://aix.software.ibm.com/aix/efixes/security/ldapauth_advisory2.asc

Vendor URL: aix.software.ibm.com/aix/efixes/security/ldapauth_advisory2.asc (Links to External Site)

Cause: Access control error

Message History: None.

Date: Fri, 04 May 2012 14:47:26 +0000
Subject: IBM AIX


http://aix.software.ibm.com/aix/efixes/security/ldapauth_advisory2.asc

CVE-2012-0745