CVE-2004-0828 — Privilege Dropping / Lowering Errors in IBM AIX

CWE-271 — Privilege Dropping / Lowering Errors4 documents4 sources
Severity
2.1LOWNVD
EPSS
0.1%
top 76.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM AIX
Timeline
PublishedNov 3
Latest updateApr 29

Description

The ctstrtcasd program in RSCT 2.3.0.0 and earlier on IBM AIX 5.2 and 5.3 does not properly drop privileges before executing the -f option, which allows local users to modify or create arbitrary files.

CVSS vector

AV:L/AC:L/C:N/I:P/A:NExploitability: 3.9 | Impact: 2.9

Affected Packages1 packages

▶NVDibm/aix5.2, 5.3+1

🔴Vulnerability Details

2
GHSA
GHSA-v74f-r59m-cjv4: The ctstrtcasd program in RSCT 2↗2022-04-29
▶
CVEList
CVE-2004-0828: The ctstrtcasd program in RSCT 2↗2004-09-28
▶

📐Framework References

1
CWE
Privilege Dropping / Lowering Errors↗
▶
CVE-2004-0828 — Privilege Dropping / Lowering Errors | cvebase