Description
The FTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly manage privileges in an RBAC environment, which allows attackers to bypass intended file-read restrictions by leveraging the setuid installation of the ftp executable file.
References
- IV28715 vendor-advisory
- IV23331 vendor-advisory
- http://aix.software.ibm.com/aix/efixes/security/ftp_advisory1.asc
- oval:org.mitre.oval:def:19695 vdb-entry signature
- IV28785 vendor-advisory
- IV28787 vendor-advisory
- 56134 vdb-entry
- aix-ftp-setuid(79279) vdb-entry