header-logo
Suggest Exploit
vendor:
AIX
by:
Arisme
9.8
CVSS
CRITICAL
Information Disclosure
200
CWE
Product Name: AIX
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE: o:ibm:aix
Metasploit:
Other Scripts:
Platforms Tested:
1998

Infod AIX exploit

Certain versions of AIX ship with an Information Daemon, infod. This program is designed to provide information about the OS and installed ancilliary programs. The daemon which runs as root, does not check credentials which are passed to it. This allows users to pass requests with arbitrary UID's. If a user passes infod a request as root, they can goto the default options menu and change the printer command line to an alternate binary such as /bin/sh that gives privileges to the account the session was spawned under.

Mitigation:

Upgrade to a version of AIX that does not have this vulnerability.
Source

Exploit-DB raw data: