Description
The getpwnam function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.1.0.10 through 2.2.1.3 does not properly interact with customer-extended LDAP user filtering, which allows local users to gain privileges via unspecified vectors.
References
- 1027021 vdb-entry
- IV19098 vendor-advisory
- IV18637 vendor-advisory
- 49073 third-party-advisory
- aix-getpwnam-privilege-escalation(74679) vdb-entry
- IV19077 vendor-advisory
- IV19097 vendor-advisory
- http://aix.software.ibm.com/aix/efixes/security/ldapauth_advisory2.asc
- IV18464 vendor-advisory
- 53393 vdb-entry
- IV18638 vendor-advisory
- 81683 vdb-entry