=====================================================================
                                  CERT-Renater

                       Note d'Information No. 2004/VULN561
_____________________________________________________________________

DATE                      : 21/12/2004

HARDWARE PLATFORM(S)      : IBM.

OPERATING SYSTEM(S)       : AIX 5.1, AIX 5.2 and AIX 5.3.

======================================================================

===========================================================================
VULNERABILITY SUMMARY

VULNERABILITY:      An untrusted path vulnerability in lsvpd allows local
users to execute arbitrary code if invoked via
invscout.

PLATFORMS:          AIX 5.1, 5.2 and 5.3.

SOLUTION:           Apply the workaround or APARs as described below.

THREAT:             A local user can execute arbitrary code with root
privileges.

CERT VU Number:     N/A
CVE Number:         CAN-2004-1054
===========================================================================

                                                       DETAILED INFORMATION

I.  Description
===============

A vulnerability was discovered in the lsvpd command that may allow any
user
to execute arbitrary code with root privileges. The lsvpd command is used
by Inventory Scout to survey a system for Vital Product Data (VPD).

The command affected by this issue ships as part of the bos.rte.methods
fileset. To determine if this fileset is installed, execute the following
command:

# lslpp -L bos.rte.methods

If the fileset is installed it will be listed along with its version
information, state, type and a description.


II. Impact
==========
The lsvpd command is only executable by the root user or users in the
system group; an unpriviliged user cannot exploit this vulnerability by
executing the lsvpd command. However, invscout invokes lsvpd with root
privileges. Since invscout has file mode bits 4555, any local user can
exploit the vulnerability in lsvpd if invscout is installed.

To determine if Inventory Scout is installed, execute the following
command:

# lslpp -L invscout.rte

If the fileset is installed it will be listed along with its version
information, state, type and a description.


III.  Solutions
===============

A. Official Fix

IBM provides the following fixes:

             APAR number for AIX 5.1.0: IY64852 (available)
             APAR number for AIX 5.2.0: IY64976 (available)
             APAR number for AIX 5.3.0: IY64820 (available)

NOTE: Affected customers are urged to upgrade to 5.1.0, 5.2.0 or 5.3.0 at
the latest maintenance level.


B. Workaround

Setting the file mode bits to 500 will allow only the root user to execute
the invscout command. This can be done by executing the following command
as
root:

# chmod 500 /usr/sbin/invscout

Verify that the file mode bits have been changed to 500:

# ls -la /usr/sbin/invscout
- - -r-x------  1 root system 141036 2002-08-29 13:16 /usr/sbin/invscout


IV. Obtaining Fixes
===================

AIX Version 5 APARs can be downloaded from the eServer pSeries Fix Central
web site:

             http://www-912.ibm.com/eserver/support/fixes/fcgui.jsp

Security related Emergency Fixes can be downloaded from:

             ftp://aix.software.ibm.com/aix/efixes/security

V.  Acknowledgments
====================
This vulnerability was reported by iDEFENSE.


VI.  Contact Information
========================

If you would like to receive AIX Security Advisories via email, please
visit:

             https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

             security-alert@austin.ibm.com

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@austin.ibm.com
with a subject of "get key". The key can also be downloaded from a
PGP Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their
respective holders.

======================================================================

         =========================================================
         Les serveurs de référence du CERT-Renater
         http://www.urec.fr/securite
         http://www.cru.fr/securite
         http://www.renater.fr
         =========================================================
         + CERT-RENATER          | tel : 01-53-94-20-44          +
         + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
         + 75013 Paris           | email: certsvp@renater.fr     +
         =========================================================