CVE-2013-4011
published 2013-07-18CVE-2013-4011: Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via…
PriorityP337high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
2.85%
85.2th percentile
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via vectors involving (1) arp.ib or (2) ibstat.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | vios | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
ibstat $PATH - Local Privilege Escalation (Metasploit)
exploitdb·2014-04-04
CVE-2013-4011 ibstat $PATH - Local Privilege Escalation (Metasploit)
ibstat $PATH - Local Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class Metasploit4 "ibstat $PATH Privilege Escalation",
"Description" => %q{
This module exploits the trusted $PATH environment variable of the SUID binary "ibstat".
},
"Author" => [
"Kristian Erik Hermansen", #original author
"Sagi Shahar ", #Metasploit module
"Kostas Lintovois " #Metasploit module
],
"References" => [
["CVE", "2013-4011"],
["OSVDB", "95420"],
["BID", "61287"],
["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827"],
["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756"]
],
"Platform" => ["unix"],
"Arch" => ARCH_CMD,
"Payload" => {
"Compat" => {
"Paylo
Exploit-DB
IBM AIX 6.1/7.1 - Local Privilege Escalation
exploitdb·2013-09-24·CVSS 7.2
CVE-2013-4011 [HIGH] IBM AIX 6.1/7.1 - Local Privilege Escalation
IBM AIX 6.1/7.1 - Local Privilege Escalation
---
# Exploit-DB Note: Screenshot provided by exploit author
#
#!/bin/sh
# Exploit Title: IBM AIX 6.1 / 7.1 local root privilege escalation
# Date: 2013-09-24
# Exploit Author: Kristian Erik Hermansen
# Vendor Homepage: http://www.ibm.com
# Software Link: http://www-03.ibm.com/systems/power/software/aix/about.html
# Version: IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02
# Tested on: IBM AIX 6.1
# CVE: CVE-2013-4011
echo '
mm mmmmm m m
## # # #
# # # ##
#mm# # m""m
# # mm#mm m" "m
'
echo "[*] AIX root privilege escalation"
echo "[*] Kristian Erik Hermansen"
echo "[*] https://linkedin.com/in/kristianhermansen"
echo "
+++++?????????????~.:,.:+???????????++++
+++++???????????+...:.,.,.=??????????+++
+++???????????~.,:~=~:::..,.~?????????++
++
Metasploit
ibstat $PATH Privilege Escalation
metasploit
ibstat $PATH Privilege Escalation
ibstat $PATH Privilege Escalation
This module exploits the trusted $PATH environment variable of the SUID binary "ibstat".
No writeups or analysis indexed.
http://aix.software.ibm.com/aix/efixes/security/infiniband_advisory.aschttp://osvdb.org/95419http://osvdb.org/95420http://secunia.com/advisories/54215http://www.ibm.com/support/docview.wss?uid=isg1IV43561http://www.ibm.com/support/docview.wss?uid=isg1IV43562http://www.ibm.com/support/docview.wss?uid=isg1IV43580http://www.ibm.com/support/docview.wss?uid=isg1IV43582http://www.ibm.com/support/docview.wss?uid=isg1IV43756http://www.ibm.com/support/docview.wss?uid=isg1IV43827http://www.securityfocus.com/bid/61287http://www.securitytracker.com/id/1028792https://exchange.xforce.ibmcloud.com/vulnerabilities/85617https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19167http://aix.software.ibm.com/aix/efixes/security/infiniband_advisory.aschttp://osvdb.org/95419http://osvdb.org/95420http://secunia.com/advisories/54215http://www.ibm.com/support/docview.wss?uid=isg1IV43561http://www.ibm.com/support/docview.wss?uid=isg1IV43562http://www.ibm.com/support/docview.wss?uid=isg1IV43580http://www.ibm.com/support/docview.wss?uid=isg1IV43582http://www.ibm.com/support/docview.wss?uid=isg1IV43756http://www.ibm.com/support/docview.wss?uid=isg1IV43827http://www.securityfocus.com/bid/61287http://www.securitytracker.com/id/1028792https://exchange.xforce.ibmcloud.com/vulnerabilities/85617https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19167
2013-07-18
Published