The malloc subsystem in libc in IBM AIX 5.3 and 6.1 allows local users to create or overwrite arbitrary files via a symlink attack on the log file associated with the MALLOCDEBUG environment variable.

There is a race condition in the MALLOCDEBUG debugging component of the malloc subsystem in the library libc.a. A local user can exploit this race condition when executing setuid root programs and thereby overwrite any file in the system.

The successful exploitation of this vulnerability allows a local user to overwrite arbitrary files and execute arbitrary code as the root user.

The following libraries are vulnerable :

/usr/ccs/lib/libc.a /usr/ccs/lib/libp/libc.a.

ID	Name	Product	Family	Severity
64331	AIX 5.3 TL 7 : libc (IZ50517)	Nessus	AIX Local Security Checks	medium
64330	AIX 5.3 TL 0 : libc (IZ50500)	Nessus	AIX Local Security Checks	medium
64329	AIX 5.3 TL 8 : libc (IZ50447)	Nessus	AIX Local Security Checks	medium
64328	AIX 5.3 TL 9 : libc (IZ50445)	Nessus	AIX Local Security Checks	medium
64327	AIX 6.1 TL 0 : libc (IZ50139)	Nessus	AIX Local Security Checks	medium
64326	AIX 6.1 TL 1 : libc (IZ50129)	Nessus	AIX Local Security Checks	medium
64325	AIX 6.1 TL 2 : libc (IZ50121)	Nessus	AIX Local Security Checks	medium

Detections

Analytics

CVE-2009-1786

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium