Actu
Vigil@nce - IBM AIX: directory traversal via pConsole Tivoli Lightweight Infrastructure
November 2016 by Vigil@nce
This bulletin was written by Vigil@nce : https://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can traverse directories via Tivoli Lightweight
Infrastructure of IBM AIX, in order to read a file outside the
service root path.
Impacted products: AIX.
Severity: 2/4.
Creation date: 23/09/2016.
DESCRIPTION OF THE VULNERABILITY
The IBM AIX product offers an IBM System Director Console for AIX
(pConsole) service.
However, user’s data are directly inserted in an access path.
Sequences such as "/.." can thus be used to go in the upper
directory.
An attacker can therefore traverse directories via Tivoli
Lightweight Infrastructure of IBM AIX, in order to read a file
outside the service root path.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
