Executive brief
A vulnerability in the 'ping' utility of older IBM AIX operating systems could allow a local user to gain full administrative (root) control of the system. By providing an unexpectedly long command-line argument, an attacker can crash the program in a way that grants them elevated privileges. This poses a significant risk to the integrity and confidentiality of data on affected legacy systems.
Technical details
A stack-based buffer overflow exists in the /usr/sbin/ping executable on IBM AIX 4.2 and earlier. The vulnerability is triggered when the application processes an excessively long command-line argument without proper bounds checking. Because the ping utility is typically installed with setuid root permissions to handle raw sockets, an attacker can exploit this overflow to overwrite the return address on the stack and execute arbitrary code with root privileges. Exploitation requires local shell access. IBM released APARs IX62144, IX61019, and IX60927 to address this issue across different AIX versions.
Affected products
- IBM AIX 4.2 and earlier
Timeline
- 1997-07-21: disclosed: Exploit posted to Bugtraq mailing list by Bryan P. Self
- 1997-07-21: patched: IBM confirmed fixes via APARs IX62144, IX61019, and IX60927
- 1997-07-21: advisory