CVE-1999-1480: Low severity IBM AIX vulnerability
(1) acledit and (2) aclput in AIX 4.3 allow local users to create or modify files via a symlink attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
AIX/acleditfrom your environment.If acledit is not required on the system, uninstall or remove the acledit binary until a vendor patch is available.
- Remove
Remove
AIX/aclputfrom your environment.If aclput is not required on the system, uninstall or remove the aclput binary until a vendor patch is available.
- Configuration
Restrict execution of acledit and aclput to administrative/root accounts only (e.g., remove execute permission for non-privileged users or apply filesystem ACLs) until a vendor fix is available.
IBM AIX acledit and aclput execute permission = restricted to administrators - Compensating control
Limit untrusted local user capabilities and isolate unprivileged accounts (for example, restrict which users can create symlinks or access directories manipulated by acledit/aclput) until a vendor-provided fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1480?
CVE-1999-1480 is considered a medium severity vulnerability due to its potential for local file manipulation through symlink attacks.
How do I fix CVE-1999-1480?
To fix CVE-1999-1480, users should avoid using the vulnerable commands or apply any relevant patches provided by IBM for AIX 4.3.
Who is affected by CVE-1999-1480?
CVE-1999-1480 affects local users of IBM AIX 4.3, specifically those who have access to the acledit and aclput commands.
What type of attack does CVE-1999-1480 involve?
CVE-1999-1480 involves a symlink attack that allows local users to create or modify files.
Is CVE-1999-1480 a remote or local vulnerability?
CVE-1999-1480 is classified as a local vulnerability since it requires local user access to exploit.