The lsmcode program on IBM AIX 5.2, 5.3, and 6.1 does not properly handle environment variables, which allows local users to gain privileges, a different vulnerability than CVE-2004-1329.

The lsmcode command contains an environment variable handling error. A local attacker may exploit this error to execute arbitrary code with root privileges because the command is setuid root.

The following files are vulnerable :

/usr/sbin/lsmcode.

The remote host is missing AIX PTF U815023, which is related to the security of the package bos.diag.util.

The lsmcode command contains an environment variable handling error. A local attacker may exploit this error to execute arbitrary code with root privileges because the command is setuid root.

The following files are vulnerable :

/usr/sbin/lsmcode.

The remote host is missing AIX PTF U815911, which is related to the security of the package bos.diag.util.

The remote host is missing AIX PTF U813985, which is related to the security of the package bos.diag.util.

The lsmcode command contains an environment variable handling error. A local attacker may exploit this error to execute arbitrary code with root privileges because the command is setuid root.

The following files are vulnerable :

/usr/sbin/lsmcode.

ID	Name	Product	Family	Severity
63755	AIX 5.2 TL 0 : lsmcode (IZ15276)	Nessus	AIX Local Security Checks	high
63754	AIX 5.3 TL 0 : lsmcode (IZ15100)	Nessus	AIX Local Security Checks	high
32237	AIX 5.2 TL 10 : bos.diag.util (U815023)	Nessus	AIX Local Security Checks	high
31566	AIX 5.3 TL 7 : bos.diag.util (U815911)	Nessus	AIX Local Security Checks	high
31473	AIX 5.3 TL 6 : bos.diag.util (U813985)	Nessus	AIX Local Security Checks	high

Detections

Analytics

CVE-2008-1600

high

Tenable Plugins

high

high

high

high

high