CVE-2008-1599

high

Description

The nddstat programs on IBM AIX 5.2, 5.3, and 6.1 do not properly handle environment variables, which allows local users to gain privileges by invoking (1) atmstat, (2) entstat, (3) fddistat, (4) hdlcstat, or (5) tokstat.

References

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5468

https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-1600

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4158

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4157

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4156

http://www.vupen.com/english/advisories/2008/0865

http://www.ibm.com/support/docview.wss?uid=isg1IZ17059

http://www.ibm.com/support/docview.wss?uid=isg1IZ17058

http://www.ibm.com/support/docview.wss?uid=isg1IZ16991

http://www.ibm.com/support/docview.wss?uid=isg1IZ16975

http://securitytracker.com/id?1019604

Details

Source: Mitre, NVD

Published: 2008-03-31

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H