CVE-2007-5804

Description

cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create or overwrite an arbitrary file, and enable world writability of this file, by using the file's name as the argument.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/38154

http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX53&path=%2F200710%2FSECURITY%2F20071030%2Fdatafile100405

http://www.securityfocus.com/bid/26258

http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03061

http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03055

http://secunia.com/advisories/27437

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=611

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS