vendor:
AIX HACMP
by:
Kristian Erik Hermansen
8,8
CVSS
HIGH
Local Privilege Escalation
264
CWE
Product Name: AIX HACMP
Affected Version From: IBM AIX High Availability Cluster Multiprocessing (HACMP) 6.1.0
Affected Version To: IBM AIX High Availability Cluster Multiprocessing (HACMP) 6.1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:ibm:aix_hacmp:6.1.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: AIX
2018
IBM AIX High Availability Cluster Multiprocessing (HACMP) LPE to root 0day
A local privilege escalation vulnerability exists in IBM AIX High Availability Cluster Multiprocessing (HACMP) due to a lack of proper input validation. An attacker can exploit this vulnerability by creating a malicious su binary in the /tmp directory and setting the PATH environment variable to /tmp. The attacker can then execute the clpasswd utility, which will execute the malicious su binary, resulting in a root shell.
Mitigation:
Users should ensure that the PATH environment variable is not set to a user-controlled directory, and that the clpasswd utility is not accessible to unprivileged users.
