Freely subscribe to our NEWSLETTER

SYNTHESIS OF THE VULNERABILITY

A local attacker can generate an overflow in the qoslist and
qosmod commands, in order to elevate his privileges.

Severity: 2/4

Consequences: privileged access/rights

Provenance: user shell

Means of attack: no proof of concept, no attack

Ability of attacker: expert (4/4)

Confidence: confirmed by the editor (5/5)

Diffusion of the vulnerable configuration: high (3/3)

Number of vulnerabilities in this bulletin: 2

Creation date: 18/12/2009

IMPACTED PRODUCTS

– IBM AIX

DESCRIPTION OF THE VULNERABILITY

The qoslist and qosmod commands list and modify the QoS (Quality
of Service) associated to a Service Category or a Policy Rule.
They are impacted by two vulnerabilities.

An attacker can call qoslist with a long parameter, in order to
generate a buffer overflow. [grav:2/4; BID-37413, CVE-2009-4361,
IZ66917, IZ66966]

An attacker can call qosmod with a long parameter, in order to
generate a buffer overflow. [grav:2/4; BID-37412, CVE-2009-4362,
IZ66918, IZ66967]

A local attacker can therefore generate an overflow in the qoslist
and qosmod commands, in order to elevate his privileges.

CHARACTERISTICS

Identifiers: BID-37412, BID-37413, CVE-2009-4361, CVE-2009-4362,
IZ66917, IZ66918, IZ66966, IZ66967, VIGILANCE-VUL-9304

http://vigilance.fr/vulnerability/AIX-buffer-overflow-of-qoslist-and-qosmod-9304