| Vulnerability Name: | CVE-2008-5384 (CCN-46896) | ||||||||
| Assigned: | 2008-11-26 | ||||||||
| Published: | 2008-11-26 | ||||||||
| Updated: | 2017-09-29 | ||||||||
| Summary: | crontab in bos.rte.cron in IBM AIX 6.1.0 through 6.1.2 allows local users with aix.system.config.cron authorization to gain privileges by launching an editor. | ||||||||
| CVSS v3 Severity: | 4.8 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 6.9 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C) 5.1 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||
| References: | Source: CCN Type: IBM SECURITY ADVISORY, Wed Nov 26 09:16:12 CST 2008 AIX 6.1 multiple security vulnerabilities Source: CONFIRM Type: UNKNOWN http://aix.software.ibm.com/aix/efixes/security/aix61_advisory.asc Source: MITRE Type: CNA CVE-2008-5384 Source: OSVDB Type: UNKNOWN 50218 Source: CCN Type: SA32916 IBM AIX Multiple Privilege Escalation Vulnerabilities Source: SECUNIA Type: UNKNOWN 32916 Source: CCN Type: SECTRACK ID: 1021291 IBM AIX 'crontab' Command Lets Local Users Gain Elevated Privileges Source: AIXAPAR Type: Patch, Vendor Advisory IZ30248 Source: CCN Type: IBM APAR IZ30248 POTENTIAL SECURITY ISSUE Source: AIXAPAR Type: Patch, Vendor Advisory IZ34478 Source: CCN Type: IBM APAR IZ34478 POTENTIAL SECURITY ISSUE Source: AIXAPAR Type: Patch, Vendor Advisory IZ34783 Source: CCN Type: IBM APAR IZ34783 POTENTIAL SECURITY ISSUE Source: CCN Type: OSVDB ID: 50218 IBM AIX bos.rte.cron /usr/bin/crontab Editor Local Privilege Escalation Source: BID Type: UNKNOWN 32493 Source: CCN Type: BID-32493 IBM AIX Multiple Local Privilege Escalation Vulnerabilities Source: SECTRACK Type: UNKNOWN 1021291 Source: XF Type: UNKNOWN ibm-aix-crontab-privilege-escalation(46896) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:5612 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||