What’s Vulnerable › Vulnerabilities

CVE-2004-2388

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2004-12-31 · updated 2026-06-16

Description

rexecd for AIX 4.3.3 does not properly use a local copy of the pwd structure when calling getpwnam, which may cause the structure to be overwritten by the authenticate function and assign privileges to the wrong user.

Affected products

• IBM AIX: 4.3.3

References

• http://secunia.com/advisories/11085
• http://www-1.ibm.com/support/docview.wss?uid=isg1IY53507
• http://www.ciac.org/ciac/bulletins/o-102.shtml
• http://www.osvdb.org/4248
• http://www.securityfocus.com/bid/9835
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15455
• http://secunia.com/advisories/11085
• http://www-1.ibm.com/support/docview.wss?uid=isg1IY53507
• http://www.ciac.org/ciac/bulletins/o-102.shtml
• http://www.osvdb.org/4248
• http://www.securityfocus.com/bid/9835
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15455

Get alerted when CVE-2004-2388 or the next vulnerability affects your stack