swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors. NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805.

A file permission/ownership vulnerability exists in the 'bos.rte.console' fileset command listed below whereby a local attacker may create arbitrary contents within a file owned by root using the 'swcons' command. The local attacker must be a member of the 'system' group (gid=0) to execute this command.

The following commands are vulnerable :

/usr/sbin/swcons.

ID	Name	Product	Family	Severity
63773	AIX 6.1 TL 1 : swcons (IZ28943)	Nessus	AIX Local Security Checks	high
63762	AIX 6.1 TL 0 : swcons (IZ18341)	Nessus	AIX Local Security Checks	high
63761	AIX 5.3 TL 0 : swcons (IZ18339)	Nessus	AIX Local Security Checks	high
63760	AIX 5.3 TL 7 : swcons (IZ18338)	Nessus	AIX Local Security Checks	high
63759	AIX 5.2 TL 0 : swcons (IZ18335)	Nessus	AIX Local Security Checks	high
63758	AIX 5.3 TL 8 : swcons (IZ18334)	Nessus	AIX Local Security Checks	high

Detections

Analytics

CVE-2008-4018

high

Tenable Plugins

high

high

high

high

high

high