Exploitation Summary
EIP tracks 2 public exploits for CVE-2004-1054. PoCs published by ri0t, cees-bart.
AI-analyzed exploit summary This exploit leverages a PATH environment variable manipulation vulnerability in invscout to execute arbitrary commands as root. It creates a malicious 'uname' script in /tmp that copies and sets the SUID bit on /usr/bin/ksh, then executes it via the vulnerable binary.
Description
Untrusted execution path vulnerability in invscout in IBM AIX 5.1.0, 5.2.0, and 5.3.0 allows local users to gain privileges by modifying the PATH environment variable to point to a malicious "uname" program, which is executed from lsvpd after lsvpd has been invoked by invscout.
Exploits (2)
This exploit leverages a PATH environment variable manipulation vulnerability in invscout to execute arbitrary commands as root. It creates a malicious 'uname' script in /tmp that copies and sets the SUID bit on /usr/bin/ksh, then executes it via the vulnerable binary.
This exploit leverages a directory traversal vulnerability in the `lsmcode` utility to execute arbitrary commands as root. It creates a malicious `Dctrl` script in `/tmp/aap/bin/` that copies `/bin/sh` to `/tmp/.shh` and sets the SUID bit, granting root privileges.