The auditselect command is part of the audit subsystem. The command is called by the auditbin daemon if it is configured in the /etc/security/audit/bincmds file as a backend command for processing bin files.
The auditselect command selects audit records that match identified criteria and writes the records to standard output. With the auditselect command, you can filter the audit trail to obtain specific records for analysis or select specific records for long-term storage. The command takes stream or bin input from the file specified by the Trail parameter or from standard input. If you specify the $bin string as the value of the Trail parameter, the auditbin daemon substitutes the path name of the current bin file when it calls the auditselect command. The selection criteria can be entered as an expression or from the file specified by the -f flag. If the bin files are compressed, the auditselect command unpacks them prior to processing.
There is a format string vulnerability within the auditselect command due to the way it uses formatted output routines, such as printf(). The auditselect command may pass formatted output routines user-supplied data. If a local attacker with audit group membership passes a specially crafted parameter to auditselect, that parameter may be passed to a formatted output routine. Since output routines in auditselect do not adequately filter or restrict input (via a format string specifier), the attacker may be able to exploit this vulnerability.
Please note that the auditselect command executes with root privileges.
Impact
By supplying auditselectspecially crafted input, a local attacker with membership in the audit group may be able to execute arbitrary code with root privileges.
Solution
We are currently unaware of a practical solution to this problem.
Workaround
Restrict Access to Audit Group
To successfully exploit this vulnerability an attacker must have access to the audit group. By restricting membership to the audit group to trusted users, the chances of exploitation are reduced.
Systems Affected
Vendor| Status| Date Notified| Date Updated
---|---|---|---
IBM| | 28 Feb 2005| 28 Feb 2005
If you are a vendor and your product is affected, let us know.
{"id": "VU:896729", "bulletinFamily": "info", "title": "IBM AIX auditselect contains format string vulnerability", "description": "### Overview\n\nIBM AIX `auditselect` command contains a format string vulnerability that may allow a local attacker to execute arbitrary code.\n\n### Description\n\nAccording to [IBM's Command Reference](<http://publib.boulder.ibm.com/infocenter/pseries/index.jsp?topic=/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm>), the syntax and description of the `auditselect` command are as follows: \n\n`$> auditselect { `[`-e`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11674>)` \"Expression\" | `[`-f`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11675>)` File} [ `[`-m`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#auditselectflagm>)` ] [ Trail ] ` \n \n`The auditselect command is part of the audit subsystem. The command is called by the auditbin daemon if it is configured in the /etc/security/audit/bincmds file as a backend command for processing bin files.`\n\n`The auditselect command selects audit records that match identified criteria and writes the records to standard output. With the auditselect command, you can filter the audit trail to obtain specific records for analysis or select specific records for long-term storage. The command takes stream or bin input from the file specified by the Trail parameter or from standard input. If you specify the $bin string as the value of the Trail parameter, the auditbin daemon substitutes the path name of the current bin file when it calls the auditselect command. The selection criteria can be entered as an expression or from the file specified by the -f flag. If the bin files are compressed, the auditselect command unpacks them prior to processing.`\n\nThere is a format string vulnerability within the `auditselect` command due to the way it uses formatted output routines, such as `printf()`. The `auditselect` command may pass formatted output routines user-supplied data. If a local attacker with audit group membership passes a specially crafted parameter to `auditselect`, that parameter may be passed to a formatted output routine. Since output routines in `auditselect` do not adequately filter or restrict input (via a format string specifier), the attacker may be able to exploit this vulnerability. \n \nPlease note that the `auditselect` command executes with `root` privileges. \n \n--- \n \n### Impact\n\nBy supplying `auditselect `specially crafted input, a local attacker with membership in the audit group may be able to execute arbitrary code with `root` privileges. \n \n--- \n \n### Solution\n\nWe are currently unaware of a practical solution to this problem. \n \n--- \n \n**Workaround** \n \n**Restrict Access to Audit Group** \n \nTo successfully exploit this vulnerability an attacker must have access to the audit group. By restricting membership to the audit group to trusted users, the chances of exploitation are reduced. \n \n--- \n \n### Systems Affected \n\nVendor| Status| Date Notified| Date Updated \n---|---|---|--- \nIBM| | 28 Feb 2005| 28 Feb 2005 \nIf you are a vendor and your product is affected, [let us know](<mailto:cert@cert.org?Subject=VU%23896729 Vendor Status Inquiry>).\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | N/A | N/A \nTemporal | N/A | N/A \nEnvironmental | N/A | N/A \n \n### References\n\n * <http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519>\n * [http://www.idefense.com/application/poi/display?id=193&type;=vulnerabilities](<http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities>)\n * <http://www.securiteam.com/unixfocus/5OP0G15EUU.html>\n * <http://secunia.com/advisories/14198/>\n\n### Credit\n\nThis vulnerability was reported by iDEFENSE Security .\n\nThis document was written by Jeff Gennari.\n\n### Other Information\n\n * CVE IDs: [CAN-2005-0250](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2005-0250>)\n * Date Public: 08 Feb 2005\n * Date First Published: 28 Feb 2005\n * Date Last Updated: 28 Feb 2005\n * Severity Metric: 1.01\n * Document Revision: 75\n\n", "published": "2005-02-28T00:00:00", "modified": "2005-02-28T00:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.kb.cert.org/vuls/id/896729", "reporter": "CERT", "references": ["http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2005-0250", "http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519", "http://www.securiteam.com/unixfocus/5OP0G15EUU.html", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11674", "http://publib.boulder.ibm.com/infocenter/pseries/index.jsp?topic=/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm", "http://secunia.com/advisories/14198/", "http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11675", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#auditselectflagm"], "cvelist": ["CVE-2005-0250", "CVE-2005-0250"], "type": "cert", "lastseen": "2018-08-31T02:37:51", "history": [{"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2005-0250", "CVE-2005-0250"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "### Overview\n\nIBM AIX `auditselect` command contains a format string vulnerability that may allow a local attacker to execute arbitrary code.\n\n### Description\n\nAccording to [IBM's Command Reference](<http://publib.boulder.ibm.com/infocenter/pseries/index.jsp?topic=/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm>), the syntax and description of the `auditselect` command are as follows: \n\n`$> auditselect { `[`-e`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11674>)` \"Expression\" | `[`-f`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11675>)` File} [ `[`-m`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#auditselectflagm>)` ] [ Trail ] ` \n \n`The auditselect command is part of the audit subsystem. The command is called by the auditbin daemon if it is configured in the /etc/security/audit/bincmds file as a backend command for processing bin files.`\n\n`The auditselect command selects audit records that match identified criteria and writes the records to standard output. With the auditselect command, you can filter the audit trail to obtain specific records for analysis or select specific records for long-term storage. The command takes stream or bin input from the file specified by the Trail parameter or from standard input. If you specify the $bin string as the value of the Trail parameter, the auditbin daemon substitutes the path name of the current bin file when it calls the auditselect command. The selection criteria can be entered as an expression or from the file specified by the -f flag. If the bin files are compressed, the auditselect command unpacks them prior to processing.`\n\nThere is a format string vulnerability within the `auditselect` command due to the way it uses formatted output routines, such as `printf()`. The `auditselect` command may pass formatted output routines user-supplied data. If a local attacker with audit group membership passes a specially crafted parameter to `auditselect`, that parameter may be passed to a formatted output routine. Since output routines in `auditselect` do not adequately filter or restrict input (via a format string specifier), the attacker may be able to exploit this vulnerability. \n \nPlease note that the `auditselect` command executes with `root` privileges. \n \n--- \n \n### Impact\n\nBy supplying `auditselect `specially crafted input, a local attacker with membership in the audit group may be able to execute arbitrary code with `root` privileges. \n \n--- \n \n### Solution\n\nWe are currently unaware of a practical solution to this problem. \n \n--- \n \n**Workaround** \n \n**Restrict Access to Audit Group** \n \nTo successfully exploit this vulnerability an attacker must have access to the audit group. By restricting membership to the audit group to trusted users, the chances of exploitation are reduced. \n \n--- \n \n### Systems Affected \n\nVendor| Status| Date Notified| Date Updated \n---|---|---|--- \nIBM| | 28 Feb 2005| 28 Feb 2005 \nIf you are a vendor and your product is affected, [let us know](<mailto:cert@cert.org?Subject=VU%23896729 Vendor Status Inquiry>).\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | N/A | N/A \nTemporal | N/A | N/A \nEnvironmental | N/A | N/A \n \n### References\n\n * <http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519>\n * [http://www.idefense.com/application/poi/display?id=193&type;=vulnerabilities](<http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities>)\n * <http://www.securiteam.com/unixfocus/5OP0G15EUU.html>\n * <http://secunia.com/advisories/14198/>\n\n### Credit\n\nThis vulnerability was reported by iDEFENSE Security .\n\nThis document was written by Jeff Gennari.\n\n### Other Information\n\n * CVE IDs: [CAN-2005-0250](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2005-0250>)\n * Date Public: 08 Feb 2005\n * Date First Published: 28 Feb 2005\n * Date Last Updated: 28 Feb 2005\n * Severity Metric: 1.01\n * Document Revision: 75\n\n", "edition": 3, "enchantments": {"score": {"value": 7.2, "vector": "NONE"}}, "hash": "85a279e4e105e57e6c40d2016138a2c7f3fc0a4d0f8b98a4cd69f39d28f40bdc", "hashmap": [{"hash": "ef875680a1f1537583a529ef2ee6fc31", "key": "published"}, {"hash": "b6ba9fa6ea18201bf39ea635ecca9f13", "key": "type"}, {"hash": "b487907abc2410a2ef18f308b110a95d", "key": "title"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "988cddc62681a4ff2f6b311d1d264d2d", "key": "description"}, {"hash": "aad0eff925271ea7e12a27504fe89fe6", "key": "references"}, {"hash": "ef875680a1f1537583a529ef2ee6fc31", "key": "modified"}, {"hash": "11b6de5b0fc1a859906b31302c8a65d5", "key": "href"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "1054f8387eb145afcc607019e74c14b6", "key": "cvelist"}, {"hash": "5d2cfab83ed6e86a4812690790dc7ad5", "key": "reporter"}], "history": [], "href": "https://www.kb.cert.org/vuls/id/896729", "id": "VU:896729", "lastseen": "2018-08-30T20:36:18", "modified": "2005-02-28T00:00:00", "objectVersion": "1.3", "published": "2005-02-28T00:00:00", "references": ["http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2005-0250", "http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519", "http://www.securiteam.com/unixfocus/5OP0G15EUU.html", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11674", "http://publib.boulder.ibm.com/infocenter/pseries/index.jsp?topic=/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm", "http://secunia.com/advisories/14198/", "http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11675", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#auditselectflagm"], "reporter": "CERT", "title": "IBM AIX auditselect contains format string vulnerability", "type": "cert", "viewCount": 1}, "differentElements": ["cvss"], "edition": 3, "lastseen": "2018-08-30T20:36:18"}, {"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2005-0250", "CVE-2005-0250"], "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "### Overview\n\nIBM AIX `auditselect` command contains a format string vulnerability that may allow a local attacker to execute arbitrary code.\n\n### Description\n\nAccording to [IBM's Command Reference](<http://publib.boulder.ibm.com/infocenter/pseries/index.jsp?topic=/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm>), the syntax and description of the `auditselect` command are as follows: \n\n`$> auditselect { `[`-e`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11674>)` \"Expression\" | `[`-f`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11675>)` File} [ `[`-m`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#auditselectflagm>)` ] [ Trail ] ` \n \n`The auditselect command is part of the audit subsystem. The command is called by the auditbin daemon if it is configured in the /etc/security/audit/bincmds file as a backend command for processing bin files.`\n\n`The auditselect command selects audit records that match identified criteria and writes the records to standard output. With the auditselect command, you can filter the audit trail to obtain specific records for analysis or select specific records for long-term storage. The command takes stream or bin input from the file specified by the Trail parameter or from standard input. If you specify the $bin string as the value of the Trail parameter, the auditbin daemon substitutes the path name of the current bin file when it calls the auditselect command. The selection criteria can be entered as an expression or from the file specified by the -f flag. If the bin files are compressed, the auditselect command unpacks them prior to processing.`\n\n \nThere is a format string vulnerability within the `auditselect` command due to the way it uses formatted output routines, such as `printf()`. The `auditselect` command may pass formatted output routines user-supplied data. If a local attacker with audit group membership passes a specially crafted parameter to `auditselect`, that parameter may be passed to a formatted output routine. Since output routines in `auditselect` do not adequately filter or restrict input (via a format string specifier), the attacker may be able to exploit this vulnerability. \n \nPlease note that the `auditselect` command executes with `root` privileges. \n \n--- \n \n### Impact\n\nBy supplying `auditselect `specially crafted input, a local attacker with membership in the audit group may be able to execute arbitrary code with `root` privileges. \n \n--- \n \n### Solution\n\nWe are currently unaware of a practical solution to this problem. \n \n--- \n \n**Workaround** \n \n**Restrict Access to Audit Group** \n \nTo successfully exploit this vulnerability an attacker must have access to the audit group. By restricting membership to the audit group to trusted users, the chances of exploitation are reduced. \n \n--- \n \n### Systems Affected \n\nVendor| Status| Date Notified| Date Updated \n---|---|---|--- \nIBM| | 28 Feb 2005| 28 Feb 2005 \nIf you are a vendor and your product is affected, [let us know](<mailto:cert@cert.org?Subject=VU%23896729 Vendor Status Inquiry>).\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | N/A | N/A \nTemporal | N/A | N/A \nEnvironmental | N/A | N/A \n \n### References\n\n * <http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519>\n * [http://www.idefense.com/application/poi/display?id=193&type;=vulnerabilities](<http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities>)\n * <http://www.securiteam.com/unixfocus/5OP0G15EUU.html>\n * <http://secunia.com/advisories/14198/>\n\n### Credit\n\nThis vulnerability was reported by [iDEFENSE Security](<http://www.idefense.com>).\n\nThis document was written by Jeff Gennari.\n\n### Other Information\n\n * CVE IDs: [CAN-2005-0250](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2005-0250>)\n * Date Public: 08 Feb 2005\n * Date First Published: 28 Feb 2005\n * Date Last Updated: 28 Feb 2005\n * Severity Metric: 1.01\n * Document Revision: 75\n\n", "edition": 1, "enchantments": {"score": {"value": 7.2, "vector": "NONE"}}, "hash": "e758036e7ff83e516cdc69b62f2c428e37302ed0b9ac9d581c189ea7440f7059", "hashmap": [{"hash": "ef875680a1f1537583a529ef2ee6fc31", "key": "published"}, {"hash": "b6ba9fa6ea18201bf39ea635ecca9f13", "key": "type"}, {"hash": "cfd16da9581e0c21db590e40dfd9e493", "key": "cvss"}, {"hash": "a79e709837f2530ec49ca585eacf8593", "key": "description"}, {"hash": "b487907abc2410a2ef18f308b110a95d", "key": "title"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "ef875680a1f1537583a529ef2ee6fc31", "key": "modified"}, {"hash": "11b6de5b0fc1a859906b31302c8a65d5", "key": "href"}, {"hash": "fbecc838f3a5b05ca07f03b6c5074dae", "key": "references"}, {"hash": "1054f8387eb145afcc607019e74c14b6", "key": "cvelist"}, {"hash": "5d2cfab83ed6e86a4812690790dc7ad5", "key": "reporter"}], "history": [], "href": "https://www.kb.cert.org/vuls/id/896729", "id": "VU:896729", "lastseen": "2016-02-03T09:12:06", "modified": "2005-02-28T00:00:00", "objectVersion": "1.2", "published": "2005-02-28T00:00:00", "references": ["http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2005-0250", "http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519", "http://www.securiteam.com/unixfocus/5OP0G15EUU.html", "http://www.idefense.com", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11674", "http://publib.boulder.ibm.com/infocenter/pseries/index.jsp?topic=/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm", "http://secunia.com/advisories/14198/", "http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11675", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#auditselectflagm"], "reporter": "CERT", "title": "IBM AIX auditselect contains format string vulnerability", "type": "cert", "viewCount": 1}, "differentElements": ["references", "description"], "edition": 1, "lastseen": "2016-02-03T09:12:06"}, {"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2005-0250", "CVE-2005-0250"], "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "### Overview\n\nIBM AIX `auditselect` command contains a format string vulnerability that may allow a local attacker to execute arbitrary code.\n\n### Description\n\nAccording to [IBM's Command Reference](<http://publib.boulder.ibm.com/infocenter/pseries/index.jsp?topic=/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm>), the syntax and description of the `auditselect` command are as follows: \n\n`$> auditselect { `[`-e`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11674>)` \"Expression\" | `[`-f`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11675>)` File} [ `[`-m`](<http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#auditselectflagm>)` ] [ Trail ] ` \n \n`The auditselect command is part of the audit subsystem. The command is called by the auditbin daemon if it is configured in the /etc/security/audit/bincmds file as a backend command for processing bin files.`\n\n`The auditselect command selects audit records that match identified criteria and writes the records to standard output. With the auditselect command, you can filter the audit trail to obtain specific records for analysis or select specific records for long-term storage. The command takes stream or bin input from the file specified by the Trail parameter or from standard input. If you specify the $bin string as the value of the Trail parameter, the auditbin daemon substitutes the path name of the current bin file when it calls the auditselect command. The selection criteria can be entered as an expression or from the file specified by the -f flag. If the bin files are compressed, the auditselect command unpacks them prior to processing.`\n\nThere is a format string vulnerability within the `auditselect` command due to the way it uses formatted output routines, such as `printf()`. The `auditselect` command may pass formatted output routines user-supplied data. If a local attacker with audit group membership passes a specially crafted parameter to `auditselect`, that parameter may be passed to a formatted output routine. Since output routines in `auditselect` do not adequately filter or restrict input (via a format string specifier), the attacker may be able to exploit this vulnerability. \n \nPlease note that the `auditselect` command executes with `root` privileges. \n \n--- \n \n### Impact\n\nBy supplying `auditselect `specially crafted input, a local attacker with membership in the audit group may be able to execute arbitrary code with `root` privileges. \n \n--- \n \n### Solution\n\nWe are currently unaware of a practical solution to this problem. \n \n--- \n \n**Workaround** \n \n**Restrict Access to Audit Group** \n \nTo successfully exploit this vulnerability an attacker must have access to the audit group. By restricting membership to the audit group to trusted users, the chances of exploitation are reduced. \n \n--- \n \n### Systems Affected \n\nVendor| Status| Date Notified| Date Updated \n---|---|---|--- \nIBM| | 28 Feb 2005| 28 Feb 2005 \nIf you are a vendor and your product is affected, [let us know](<mailto:cert@cert.org?Subject=VU%23896729 Vendor Status Inquiry>).\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | N/A | N/A \nTemporal | N/A | N/A \nEnvironmental | N/A | N/A \n \n### References\n\n * <http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519>\n * [http://www.idefense.com/application/poi/display?id=193&type;=vulnerabilities](<http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities>)\n * <http://www.securiteam.com/unixfocus/5OP0G15EUU.html>\n * <http://secunia.com/advisories/14198/>\n\n### Credit\n\nThis vulnerability was reported by iDEFENSE Security .\n\nThis document was written by Jeff Gennari.\n\n### Other Information\n\n * CVE IDs: [CAN-2005-0250](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2005-0250>)\n * Date Public: 08 Feb 2005\n * Date First Published: 28 Feb 2005\n * Date Last Updated: 28 Feb 2005\n * Severity Metric: 1.01\n * Document Revision: 75\n\n", "edition": 2, "enchantments": {"score": {"value": 7.2, "vector": "NONE"}}, "hash": "75e844a9921ce56a6386417cabb65cac34c05c12b9ffdd002944ecba46e6b471", "hashmap": [{"hash": "ef875680a1f1537583a529ef2ee6fc31", "key": "published"}, {"hash": "b6ba9fa6ea18201bf39ea635ecca9f13", "key": "type"}, {"hash": "cfd16da9581e0c21db590e40dfd9e493", "key": "cvss"}, {"hash": "b487907abc2410a2ef18f308b110a95d", "key": "title"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "988cddc62681a4ff2f6b311d1d264d2d", "key": "description"}, {"hash": "aad0eff925271ea7e12a27504fe89fe6", "key": "references"}, {"hash": "ef875680a1f1537583a529ef2ee6fc31", "key": "modified"}, {"hash": "11b6de5b0fc1a859906b31302c8a65d5", "key": "href"}, {"hash": "1054f8387eb145afcc607019e74c14b6", "key": "cvelist"}, {"hash": "5d2cfab83ed6e86a4812690790dc7ad5", "key": "reporter"}], "history": [], "href": "https://www.kb.cert.org/vuls/id/896729", "id": "VU:896729", "lastseen": "2018-08-02T21:56:55", "modified": "2005-02-28T00:00:00", "objectVersion": "1.3", "published": "2005-02-28T00:00:00", "references": ["http://web.nvd.nist.gov/view/vuln/detail?vulnId=CAN-2005-0250", "http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519", "http://www.securiteam.com/unixfocus/5OP0G15EUU.html", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11674", "http://publib.boulder.ibm.com/infocenter/pseries/index.jsp?topic=/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm", "http://secunia.com/advisories/14198/", "http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#a163c11675", "http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds1/auditselect.htm#auditselectflagm"], "reporter": "CERT", "title": "IBM AIX auditselect contains format string vulnerability", "type": "cert", "viewCount": 1}, "differentElements": ["cvss"], "edition": 2, "lastseen": "2018-08-02T21:56:55"}], "edition": 4, "hashmap": [{"key": "bulletinFamily", "hash": "caf9b6b99962bf5c2264824231d7a40c"}, {"key": "cvelist", "hash": "1054f8387eb145afcc607019e74c14b6"}, {"key": "cvss", "hash": "cfd16da9581e0c21db590e40dfd9e493"}, {"key": "description", "hash": "988cddc62681a4ff2f6b311d1d264d2d"}, {"key": "href", "hash": "11b6de5b0fc1a859906b31302c8a65d5"}, {"key": "modified", "hash": "ef875680a1f1537583a529ef2ee6fc31"}, {"key": "published", "hash": "ef875680a1f1537583a529ef2ee6fc31"}, {"key": "references", "hash": "aad0eff925271ea7e12a27504fe89fe6"}, {"key": "reporter", "hash": "5d2cfab83ed6e86a4812690790dc7ad5"}, {"key": "title", "hash": "b487907abc2410a2ef18f308b110a95d"}, {"key": "type", "hash": "b6ba9fa6ea18201bf39ea635ecca9f13"}], "hash": "75e844a9921ce56a6386417cabb65cac34c05c12b9ffdd002944ecba46e6b471", "viewCount": 1, "enchantments": {"score": {"value": 7.2, "vector": "NONE"}, "vulnersScore": 7.2}, "objectVersion": "1.3"}
{"cve": [{"lastseen": "2017-07-11T11:14:46", "references": ["http://www.securityfocus.com/bid/12496", "http://www.kb.cert.org/vuls/id/896729", "http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519", "http://www-1.ibm.com/support/docview.wss?uid=isg1IY67802", "http://securitytracker.com/id?1013103", "http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities&flashstatus=false", "http://www-1.ibm.com/support/docview.wss?uid=isg1IY67472", "https://exchange.xforce.ibmcloud.com/vulnerabilities/19255"], "description": "Format string vulnerability in auditselect on IBM AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via format string specifiers in a command line argument.", "edition": 2, "reporter": "NVD", "published": "2005-05-02T00:00:00", "title": "CVE-2005-0250", "type": "cve", "enchantments": {"score": {"modified": "2017-07-11T11:14:46", "vector": "NONE", "value": 7.2}}, "assessment": {"system": "", "name": "", "href": ""}, "bulletinFamily": "NVD", "cvelist": ["CVE-2005-0250"], "scanner": [], "modified": "2017-07-10T21:32:10", "cpe": ["cpe:/o:ibm:aix:5.1", "cpe:/o:ibm:aix:5.2", "cpe:/o:ibm:aix:5.3"], "id": "CVE-2005-0250", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-0250", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:09", "references": [], "edition": 1, "description": "# No description provided by the source\n\n## References:\n[Vendor Specific Advisory URL](http://archives.neohapsis.com/archives/bugtraq/2005-02/0083.html)\n[Vendor Specific Advisory URL](http://www.ibm.com/support/docview.wss?uid=isg1IY67519)\nSecurity Tracker: 1013103\n[Secunia Advisory ID:14198](https://secuniaresearch.flexerasoftware.com/advisories/14198/)\nOther Advisory URL: http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities\nMail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2005-02/0079.html\n[CVE-2005-0250](https://vulners.com/cve/CVE-2005-0250)\n", "reporter": "OSVDB", "published": "2005-02-08T03:39:32", "title": "AIX auditselect Format String Local Privilege Escalation", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2005-0250"], "modified": "2005-02-08T03:39:32", "href": "https://vulners.com/osvdb/OSVDB:13638", "id": "OSVDB:13638", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}
