CVE-1999-1405
IBM AIX < 4.3.2 - Unprotected User Data Exposure via /tmp/ibmsupt Directory
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-1999-1405. PoCs published by Larry W. Cashdollar.
AI-analyzed exploit summary The exploit describes a symlink attack vulnerability in the AIX 'snap' command, which can leak password hashes by creating a directory and file in /tmp/ibmsupt/general/ before root executes 'snap -a'. This defeats password shadowing due to improper file handling.
Description
snap command in AIX before 4.3.2 creates the /tmp/ibmsupt directory with world-readable permissions and does not remove or clear the directory when snap -a is executed, which could allow local users to access the shadowed password file by creating /tmp/ibmsupt/general/passwd before root runs snap -a.
Exploits (1)
The exploit describes a symlink attack vulnerability in the AIX 'snap' command, which can leak password hashes by creating a directory and file in /tmp/ibmsupt/general/ before root executes 'snap -a'. This defeats password shadowing due to improper file handling.