CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
EPSS
Percentile
5.2%
IBM AIX auditselect
command contains a format string vulnerability that may allow a local attacker to execute arbitrary code.
According to IBM’s Command Reference, the syntax and description of the auditselect
command are as follows:
$> auditselect {
-e
"Expression" |
-f
File} [
-m
] [ Trail ]
The auditselect command is part of the audit subsystem. The command is called by the auditbin daemon if it is configured in the /etc/security/audit/bincmds file as a backend command for processing bin files.
The auditselect command selects audit records that match identified criteria and writes the records to standard output. With the auditselect command, you can filter the audit trail to obtain specific records for analysis or select specific records for long-term storage. The command takes stream or bin input from the file specified by the Trail parameter or from standard input. If you specify the $bin string as the value of the Trail parameter, the auditbin daemon substitutes the path name of the current bin file when it calls the auditselect command. The selection criteria can be entered as an expression or from the file specified by the -f flag. If the bin files are compressed, the auditselect command unpacks them prior to processing.
There is a format string vulnerability within the auditselect
command due to the way it uses formatted output routines, such as printf()
. The auditselect
command may pass formatted output routines user-supplied data. If a local attacker with audit group membership passes a specially crafted parameter to auditselect
, that parameter may be passed to a formatted output routine. Since output routines in auditselect
do not adequately filter or restrict input (via a format string specifier), the attacker may be able to exploit this vulnerability.
Please note that the auditselect
command executes with root
privileges.
By supplying auditselect
specially crafted input, a local attacker with membership in the audit group may be able to execute arbitrary code with root
privileges.
We are currently unaware of a practical solution to this problem.
Workaround
Restrict Access to Audit Group
To successfully exploit this vulnerability an attacker must have access to the audit group. By restricting membership to the audit group to trusted users, the chances of exploitation are reduced.
896729
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: February 28, 2005 Updated: February 28, 2005
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Please see <http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519>.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23896729 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
This vulnerability was reported by iDEFENSE Security.
This document was written by Jeff Gennari.
CVE IDs: | CVE-2005-0250 |
---|---|
Severity Metric: | 1.01 Date Public: |