Kod programskog paketa Sendmail uočena je ranjivost koju lokalni napadači mogu iskoristiti za dobivanje većih privilegija i pokretanje proizvoljnih naredbi.

IBM AIX Sendmail Privilege Escalation Vulnerability
Secunia Advisory 	SA49723 	
Release Date 	2012-06-27
Criticality level 	Less criticalLess critical
Impact 	Privilege escalation
Where 	Local system
Authentication level 	Available in Customer Area
  	 
Report reliability 	Available in Customer Area
Solution Status 	Vendor Patch
  	 
Systems affected 	Available in Customer Area
Approve distribution 	Available in Customer Area
Remediation status 	Secunia CSI, Secunia PSI
Automated scanning 	Secunia CSI, Secunia PSI
  	 
Operating System	
	AIX 6.x
	AIX 7.x

Secunia CVSS Score 	Available in Customer Area
CVE Reference(s) 	CVE-2012-2200 CVSS available in Customer Area
	   	

Description

A vulnerability has been reported in AIX sendmail, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to an error when handling certain constructs in a user's $HOME/.forward file, which can be exploited to execute arbitrary commands with root privileges.

The vulnerability is reported in AIX versions 6.1 and 7.1.

Solution
Apply the interim fix or APARs.
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Original Advisory
IBM:
http://aix.software.ibm.com/aix/efixes/security/sendmail1_advisory.asc

X-Force:
http://xforce.iss.net/xforce/xfdb/76466