CVE-2009-2669
published 2009-08-05CVE-2009-2669: A certain debugging component in IBM AIX 5.3 and 6.1 does not properly handle the (1) _LIB_INIT_DBG and (2) _LIB_INIT_DBG_FILE environment variables, which…
PriorityP337high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
0.71%
50.0th percentile
A certain debugging component in IBM AIX 5.3 and 6.1 does not properly handle the (1) _LIB_INIT_DBG and (2) _LIB_INIT_DBG_FILE environment variables, which allows local users to gain privileges by leveraging a setuid-root program to create an arbitrary root-owned file with world-writable permissions, related to libC.a (aka the XL C++ runtime library) in AIX 5.3 and libc.a in AIX 6.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Local Privilege Escalation
exploitdb·2016-11-04·CVSS 6.9
CVE-2016-6079 [MEDIUM] IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Local Privilege Escalation
IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Local Privilege Escalation
---
#!/usr/bin/sh
#
# AIX lquerylv 5.3, 6.1, 7.1, 7.2 local root exploit. Tested against latest patchset (7100-04)
#
# This exploit takes advantage of known issues with debugging functions
# within the AIX linker library. We are taking advantage of known
# functionality, and focusing on badly coded SUID binaries which do not
# adhere to proper security checks prior to seteuid/open/writes.
#
# The CVEs we will be taking advantage of:
# - CVE-2009-1786: The malloc subsystem in libc in IBM AIX 5.3 and 6.1 allows
# local users to create or overwrite arbitrary files via a symlink attack on
# the log file associated with the MALLOCDEBUG environment variable.
#
# - CVE-2009-2669: A certain debugging component in IBM AIX 5.3 and 6.1
Exploit-DB
IBM AIX 5.6/6.1 - '_LIB_INIT_DBG' Arbitrary File Overwrite via Libc Debug
exploitdb·2009-09-11·CVSS 7.2
CVE-2009-2669 [HIGH] IBM AIX 5.6/6.1 - '_LIB_INIT_DBG' Arbitrary File Overwrite via Libc Debug
IBM AIX 5.6/6.1 - '_LIB_INIT_DBG' Arbitrary File Overwrite via Libc Debug
---
#!/bin/sh
#
# $Id: raptor_libC,v 1.1 2009/09/10 15:08:04 raptor Exp $
#
# raptor_libC - AIX arbitrary file overwrite via libC debug
# Copyright (c) 2009 Marco Ivaldi
#
# Property of @ Mediaservice.net Srl Data Security Division
# http://www.mediaservice.net/ http://lab.mediaservice.net/
#
# *** DON'T RUN THIS UNLESS YOU KNOW WHAT YOU ARE DOING ***
#
# A certain debugging component in IBM AIX 5.3 and 6.1 does not properly handle
# the (1) _LIB_INIT_DBG and (2) _LIB_INIT_DBG_FILE environment variables, which
# allows local users to gain privileges by leveraging a setuid-root program to
# create an arbitrary root-owned file with world-writable permissions, related
# to libC.a (aka the XL C++ runtime library) in A
No writeups or analysis indexed.
http://aix.software.ibm.com/aix/efixes/security/libC_advisory.aschttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=815http://secunia.com/advisories/36156http://www.ibm.com/support/docview.wss?uid=isg1IZ54090http://www.ibm.com/support/docview.wss?uid=isg1IZ54091http://www.ibm.com/support/docview.wss?uid=isg1IZ54593http://www.ibm.com/support/docview.wss?uid=isg1IZ56203http://www.ibm.com/support/docview.wss?uid=isg1IZ56204http://www.ibm.com/support/docview.wss?uid=isg1IZ56205http://www.ibm.com/support/docview.wss?uid=isg1IZ56206http://www.securityfocus.com/bid/35934http://www.vupen.com/english/advisories/2009/2151http://aix.software.ibm.com/aix/efixes/security/libC_advisory.aschttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=815http://secunia.com/advisories/36156http://www.ibm.com/support/docview.wss?uid=isg1IZ54090http://www.ibm.com/support/docview.wss?uid=isg1IZ54091http://www.ibm.com/support/docview.wss?uid=isg1IZ54593http://www.ibm.com/support/docview.wss?uid=isg1IZ56203http://www.ibm.com/support/docview.wss?uid=isg1IZ56204http://www.ibm.com/support/docview.wss?uid=isg1IZ56205http://www.ibm.com/support/docview.wss?uid=isg1IZ56206http://www.securityfocus.com/bid/35934http://www.vupen.com/english/advisories/2009/2151
2009-08-05
Published