CVE-1999-1486

Vulnerability

The sadc utility in IBM AIX versions 4.1 through 4.3, when invoked by setgid adm programs such as timex, is vulnerable to a symlink attack. The vulnerability lies in the way sadc handles file operations without proper checks, allowing a local user to create a symbolic link to an arbitrary file.

Exploitation

A local attacker with the ability to run the setgid adm program (e.g., timex) can exploit this by creating a symbolic link from the file that sadc intends to write to, pointing to an arbitrary file on the system. The attacker must have local access and the ability to create symlinks.

Impact

Successful exploitation allows the attacker to overwrite arbitrary files on the system, potentially leading to privilege escalation or denial of service by corrupting critical system files.

Mitigation

IBM released fixes for this issue via APARs IX76853, IX75554, and IX76330 for AIX 4.1, 4.2, and 4.3 respectively. Users should apply the appropriate fix from IBM. As these are very old versions, upgrading to a supported AIX version is recommended.