CVE-1999-1486: Low severity IBM AIX vulnerability
sadc in IBM AIX 4.1 through 4.3, when called from programs such as timex that are setgid adm, allows local users to overwrite arbitrary files via a symlink attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
sadcfrom your environment.If sadc is not required on the system, uninstall or disable the sadc binary to eliminate the vulnerable code path that can be exploited via setgid callers.
- Configuration
Remove the setgid 'adm' bit from timex and any other programs that call sadc so they do not run with adm group privileges (for example, chmod g-s on the affected binaries).
timex and other programs that invoke sadc setgid adm bit = remove - Compensating control
Ensure directories and files written to by sadc (and by programs that invoke it) are not writable by unprivileged local users to prevent symlink-based overwrites; restrict directory write permissions to trusted administrators only.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1486?
CVE-1999-1486 is considered a high-severity vulnerability due to the potential for local users to exploit it via a symlink attack.
How do I fix CVE-1999-1486?
To mitigate CVE-1999-1486, you should apply the relevant patches provided by IBM for affected versions of AIX.
Which versions of AIX are affected by CVE-1999-1486?
AIX versions 4.1 through 4.3 are affected by CVE-1999-1486.
What attack vector does CVE-1999-1486 utilize?
CVE-1999-1486 utilizes a symlink attack to allow local users to overwrite arbitrary files.
What programs are associated with the exploitation of CVE-1999-1486?
The vulnerability can be exploited when sadc is called from programs like timex that are setgid adm.