CVE-2004-1054

Untrusted execution path vulnerability in invscout in IBM AIX 5.1.0, 5.2.0, and 5.3.0 allows local users to gain privileges by modifying the PATH environment variable to point to a malicious "uname" program, which is executed from lsvpd after lsvpd has been invoked by invscout.

Affected products

Aix

Ibm Aix

= 5.1, 5.1l, 5.2, 5.2.2, 5.2_l, 5.3, 5.3_l

Fix

Available

CVSS 2.0

7.2 HIGH

EPSS

1.0% (58th percentile)

NVD status

Modified

Published

2004-12-22