CVE-2004-1329

Vulnerability

In AIX versions 5.1 through 5.3, the setuid-root diagnostic binaries lsmcode, diag_exec, invscout, and invscoutd use the DIAGNOSTICS environment variable unsafely to locate and execute the Dctrl tool. [1] The path specified by DIAGNOSTICS is prepended to bin/Dctrl and executed as root without validation. Affected are AIX 5.1, 5.2, and 5.3.

Exploitation

An attacker with local access can create a directory structure with a malicious Dctrl script (e.g., in /tmp/aap/bin/Dctrl), set DIAGNOSTICS to that directory, and run any of the affected binaries. [1][4] The binary will execute the attacker's Dctrl as root, allowing arbitrary commands. No authentication beyond a local shell is needed.

Impact

Successful exploitation grants the attacker a root shell or allows execution of arbitrary code with root privileges. [1] This is a full compromise of the system.

Mitigation

IBM has released fixes: APAR IY64389 for AIX 5.1, IY64523 for AIX 5.2, and IY64277 for AIX 5.3. [1] These patches should be applied. Workarounds include removing setuid permissions from the binaries or restricting access to trusted users.