CVE-2000-0080

Vulnerability

The techlibss program, part of the AIX techlib.service.rte fileset, creates log files with fixed names in /tmp using shell redirection. It does not check for existing symbolic links, so if a symlink with that name exists, the program follows it and overwrites the target file. Versions prior to techlib.service.rte.1.0.0.4 are affected, with the fix included in the January 2000 service CD [1].

Exploitation

A local attacker can create a symbolic link in /tmp pointing to a critical file (e.g., /etc/passwd). When the root user runs techlibss (which executes with root privileges), the program will overwrite the target file with the log output [1].

Impact

Successful exploitation allows a local attacker to overwrite arbitrary files on the system, potentially leading to denial of service or privilege escalation. Since the program runs as root, the attacker can overwrite any file the root user can write to [1].

Mitigation

The fix is available in techlib.service.rte.1.0.0.4 on the January 2000 service CD. Upgrade manually to this version, as the fileset is not updated automatically even when choosing automatic update from the CD. If an older version is installed, follow the upgrade instructions on the CD cover [1].