VULHUB ™

The IBM AIX runtime linker is reported to use an insecure search path for dynamic libraries for programs that are compiled with a non-AIX compiler, such as GCC. The current directory will be searched before other system directories. An attacker could take advantage of this condition by placing a malicious library in the current working directory. This could allow for privilege escalation with programs that are setuid/setgid. This issue is well documented in the AIX man pages. It is a deviation from the behavior of other Unix linkers, and as such may be confusing to those who are not familiar with the AIX specific behavior. Portable OpenSSH compiled with GCC was reported as an example of a program that may introduce this issue, though the problem itself is due to the behavior of the runtime linker. This issue was also reported with Sendmail 8.10, compiled with a non-native compiler.

The IBM AIX runtime linker is reported to use an insecure search path for dynamic libraries for programs that are compiled with a non-AIX compiler, such as GCC. The current directory will be searched before other system directories. An attacker could take advantage of this condition by placing a malicious library in the current working directory. This could allow for privilege escalation with programs that are setuid/setgid. This issue is well documented in the AIX man pages. It is a deviation from the behavior of other Unix linkers, and as such may be confusing to those who are not familiar with the AIX specific behavior. Portable OpenSSH compiled with GCC was reported as an example of a program that may introduce this issue, though the problem itself is due to the behavior of the runtime linker. This issue was also reported with Sendmail 8.10, compiled with a non-native compiler.