CVE-2008-1599

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-03-31 · updated 2026-06-16
Weakness: CWE-264

Description

The nddstat programs on IBM AIX 5.2, 5.3, and 6.1 do not properly handle environment variables, which allows local users to gain privileges by invoking (1) atmstat, (2) entstat, (3) fddistat, (4) hdlcstat, or (5) tokstat.

Affected products

IBM AIX: 5.2, 5.3, 6.1

References

http://securitytracker.com/id?1019604
http://www.ibm.com/support/docview.wss?uid=isg1IZ16975
http://www.ibm.com/support/docview.wss?uid=isg1IZ16991
http://www.ibm.com/support/docview.wss?uid=isg1IZ17058
http://www.ibm.com/support/docview.wss?uid=isg1IZ17059
http://www.vupen.com/english/advisories/2008/0865
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4156
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4157
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4158
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5468
http://securitytracker.com/id?1019604
http://www.ibm.com/support/docview.wss?uid=isg1IZ16975

Get alerted when CVE-2008-1599 or the next vulnerability affects your stack