Description
snap command in AIX before 4.3.2 creates the /tmp/ibmsupt directory with world-readable permissions and does not remove or clear the directory when snap -a is executed, which could allow local users to access the shadowed password file by creating /tmp/ibmsupt/general/passwd before root runs snap -a.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Larry W. Cashdollar · textlocalaix
https://www.exploit-db.com/exploits/19300
References (3)
Core 3
Core References
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=91954824614013&w=2
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/375
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=91936783009385&w=2
Scores
EPSS
0.0748
EPSS Percentile
91.8%
Details
Status
published
Products (8)
ibm/aix
3.2.5
ibm/aix
4.1
ibm/aix
4.1.2
ibm/aix
4.1.3
ibm/aix
4.1.4
ibm/aix
4.1.5
ibm/aix
4.2
ibm/aix
4.2.1
Published
Feb 17, 1999
Tracked Since
Feb 18, 2026