CVE-2014-3977

Published: Jun 8, 2014Modified: May 6, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179.

Affected (19)

Products: Ibm: Aix, Vios

2 products

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Ibm Aix	Version 6.1
Ibm Aix	Version 7.1
Ibm Vios	Version 2.2.0.10
Ibm Vios	Version 2.2.0.11
Ibm Vios	Version 2.2.0.12
Ibm Vios	Version 2.2.0.13
Ibm Vios	Version 2.2.1.0
Ibm Vios	Version 2.2.1.1
Ibm Vios	Version 2.2.1.3
Ibm Vios	Version 2.2.1.4
Ibm Vios	Version 2.2.1.4 fp-25_sp-02
Ibm Vios	Version 2.2.1.8
Ibm Vios	Version 2.2.1.9
Ibm Vios	Version 2.2.2.0
Ibm Vios	Version 2.2.2.4
Ibm Vios	Version 2.2.2.5
Ibm Vios	Version 2.2.3.0
Ibm Vios	Version 2.2.3.2
Ibm Vios	Version 2.2.3.3

Related CWEs

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (24)

http://aix.software.ibm.com/aix/efixes/security/libodm_advisory.asc

Source: cve@mitre.org

http://packetstormsecurity.com/files/127067/IBM-AIX-6.1.8-Privilege-Escalation.html

Source: cve@mitre.org

http://www.exploit-db.com/exploits/33725

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IV60299

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IV60303

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IV60311

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IV60312

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IV60313

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IV60314

Source: cve@mitre.org

http://www.securitytracker.com/id/1030401

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/93595

Source: cve@mitre.org

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3977/

Source: cve@mitre.org

http://aix.software.ibm.com/aix/efixes/security/libodm_advisory.asc

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.com/files/127067/IBM-AIX-6.1.8-Privilege-Escalation.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.exploit-db.com/exploits/33725

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IV60299

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IV60303

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IV60311

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IV60312

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IV60313

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IV60314

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1030401

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/93595

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3977/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.