Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create an arbitrary file, and enable world writability of this file, via a symlink attack involving use of the file's name as the argument. NOTE: this issue is due to an incomplete fix for CVE-2007-5804.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
IBM AIX swcons本地用户权限提升漏洞
Vulnerability Description
IBM AIX是一款商业性质的UNIX操作系统。 AIX的swcons工具实现上存在漏洞，本地攻击者可能利用此漏洞提升权限。 多个AIX版本中所捆绑的swcons工具在使用-p选项时没有执行过滤检查，如果用户使用这个选项指定了文件的话，就会用65535字节的非受控数据覆盖该文件内容，这种情况都会将文件转换到222模式，而该模式允许系统上的所有用户修改文件，可能导致以root权限执行任意指令。但在默认的配置中，必须拥有组ID system才能执行swcons。
CVSS Information
N/A
Vulnerability Type
N/A