CVE-1999-1405: Critical severity IBM AIX vulnerability
snap command in AIX before 4.3.2 creates the /tmp/ibmsupt directory with world-readable permissions and does not remove or clear the directory when snap -a is executed, which could allow local users to access the shadowed password file by creating /tmp/ibmsupt/general/passwd before root runs snap -a.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify snap so that it does not create /tmp/ibmsupt with world-readable permissions and so that snap -a removes or clears /tmp/ibmsupt when finished. Ensure the directory is created with restrictive permissions (not world-readable).
snap (AIX) creation permissions and cleanup of /tmp/ibmsupt = do not create /tmp/ibmsupt with world-readable permissions; ensure directory is removed or cleared after snap -a - Compensating control
Prevent unprivileged users from creating /tmp/ibmsupt (for example, using filesystem permissions or ACLs on /tmp or on /tmp/ibmsupt) so local users cannot pre-create /tmp/ibmsupt/general/passwd before snap -a is run.
- Operational
Before running snap -a as root, verify that /tmp/ibmsupt and /tmp/ibmsupt/general/passwd do not exist and remove them if present. Do not run snap -a while unprivileged users could have pre-created those paths.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1405?
CVE-1999-1405 is considered a high severity vulnerability due to its potential to expose sensitive data.
How do I fix CVE-1999-1405?
To fix CVE-1999-1405, update AIX to a version that addresses this vulnerability or modify the permissions of the /tmp/ibmsupt directory.
Who is affected by CVE-1999-1405?
CVE-1999-1405 affects local users on AIX versions 3.2.5 and 4.x before 4.3.2.
What could exploit CVE-1999-1405?
An attacker could exploit CVE-1999-1405 by creating a specific directory structure to gain unauthorized access to the shadowed password file.
What is the impact of CVE-1999-1405?
The impact of CVE-1999-1405 could include unauthorized local user access to sensitive system files like the shadowed password file.