CVE-2007-5804

Severity: medium (CVSS 6.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-11-05 · updated 2026-06-16

Description

cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create or overwrite an arbitrary file, and enable world writability of this file, by using the file's name as the argument.

Affected products

IBM AIX: 5.2, 5.3

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=611
http://secunia.com/advisories/27437
http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03055
http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03061
http://www.securityfocus.com/bid/26258
http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX53&path=%2F200710%2FSECURITY%2F20071030%2Fdatafile100405
https://exchange.xforce.ibmcloud.com/vulnerabilities/38154
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=611
http://secunia.com/advisories/27437
http://www-1.ibm.com/support/docview.wss?uid=isg1IZ03055

Get alerted when CVE-2007-5804 or the next vulnerability affects your stack