Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An authenticated attacker can use the ftp client, in order to read
files which are read protected.

Impacted products: AIX

Severity: 2/4

Creation date: 19/10/2012

DESCRIPTION OF THE VULNERABILITY

The ftp client can be used to connect to a local or remote FTP
server, in order to read or upload files.

The ftp service uses RBAC (Role Based Access Control) to process
user’s privileges. However, in order to provide a compatibility
with older systems, it also changes the current user with
setuid(). The ftp client can then read files as root. Full
technical details are unknown.

An authenticated attacker can therefore use the ftp client, in
order to read files which are read protected.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/AIX-privileged-read-via-ftp-12084