what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

iDEFENSE Security Advisory 2007-10-30.3

Posted Oct 31, 2007

Authored by iDefense Labs | Site idefense.com

iDefense Security Advisory 10.30.07 - Local exploitation of an integer underflow vulnerability in the dig program of IBM Corp.'s AIX operating system allows attackers to execute arbitrary code with root privileges. The problem specifically exists within dns_name_fromtext function within the libdns.a library. This function is called when processing the '-y' command line parameter to the dig program. By supplying a specially crafted TSIG key parameter, an attacker is able to cause an integer underflow, resulting in potentially exploitable heap corruption. iDefense has confirmed the existence of this vulnerability within AIX version 5.2. Previous versions are suspected to be vulnerable. AIX 5.3 is not vulnerable since the dig command is no longer installed set-uid root.

tags | advisory, arbitrary, local, root

systems | aix

advisories | CVE-2007-4622

SHA-256 | ec26bd7b077f967aa8a68f926d03462460aa6ced38d18b3c6d83bfa3e540affe

Download | Favorite | View

Related Files

No related files