Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-2669 — IBM AIX vulnerability

CWE-2645 documents4 sources
Severity
7.2HIGHNVD
EPSS
0.1%
top 76.91%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
IBM AIX
Timeline
PublishedAug 5
Latest updateMay 2

Description

A certain debugging component in IBM AIX 5.3 and 6.1 does not properly handle the (1) _LIB_INIT_DBG and (2) _LIB_INIT_DBG_FILE environment variables, which allows local users to gain privileges by leveraging a setuid-root program to create an arbitrary root-owned file with world-writable permissions, related to libC.a (aka the XL C++ runtime library) in AIX 5.3 and libc.a in AIX 6.1.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages1 packages

▶NVDibm/aix5.3, 6.1+1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-wfhq-rjjw-5xwh: A certain debugging component in IBM AIX 5↗2022-05-02
▶
CVEList
CVE-2009-2669: A certain debugging component in IBM AIX 5↗2009-08-05
▶

💥Exploits & PoCs

2
Exploit-DB
IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Local Privilege Escalation↗2016-11-04
▶
Exploit-DB
IBM AIX 5.6/6.1 - '_LIB_INIT_DBG' Arbitrary File Overwrite via Libc Debug↗2009-09-11
▶
CVE-2009-2669 — IBM AIX vulnerability | cvebase