6.9

CVE-2004-2697

Exploit
The Inventory Scout daemon (invscoutd) 1.3.0.0 and 2.0.2 for AIX 4.3.3 and 5.1 allows local users to gain privileges via a symlink attack on a command line argument (log file).  NOTE: this might be related to CVE-2006-5002.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Aix Version4.3.3
Ibm ≫ Aix Version5.1
Ibm ≫ Aix Version5.1l
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.435
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

http://secunia.com/advisories/11200
Vendor Advisory
http://www.osvdb.org/4582
http://www.securiteam.com/exploits/5CP0F0UDFG.html
http://www.securityfocus.com/bid/9982
Exploit
http://www.xfocus.org/exploits/200403/31.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/15620