vulnwire
7.2high

CVE-2008-4018

swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, a…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 33%
Public exploits
0
none known

swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors. NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805.

Exploit prediction (EPSS)

0.39% probability of exploitation in the next 30 days, higher than 33% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • aix.software.ibm.com /aix/efixes/security/swcons_advisory.asc · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/31739 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • ibm.com /support/docview.wss?uid=isg1IZ18335 · vendor-advisory, x_refsource_AIXAPAR, x_transferred
  • vupen.com /english/advisories/2008/2490 · vdb-entry, x_refsource_VUPEN, x_transferred
  • ibm.com /support/docview.wss?uid=isg1IZ18334 · vendor-advisory, x_refsource_AIXAPAR, x_transferred
  • ibm.com /support/docview.wss?uid=isg1IZ18338 · vendor-advisory, x_refsource_AIXAPAR, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/44903 · vdb-entry, x_refsource_XF, x_transferred
  • ibm.com /support/docview.wss?uid=isg1IZ28943 · vendor-advisory, x_refsource_AIXAPAR, x_transferred
  • ibm.com /support/docview.wss?uid=isg1IZ18339 · vendor-advisory, x_refsource_AIXAPAR, x_transferred
  • securityfocus.com /bid/30999 · vdb-entry, x_refsource_BID, x_transferred
  • ibm.com /support/docview.wss?uid=isg1IZ18341 · vendor-advisory, x_refsource_AIXAPAR, x_transferred
  • securitytracker.com /id?1020818 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5932 · vdb-entry, signature, x_refsource_OVAL, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.