IBM AIX 4.3.3 mail/mailx memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in IBM AIX 4.3.3. The affected element is an unknown function of the component mail/mailx. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2002-0743. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM AIX 4.3.3 (Operating System). It has been rated as very critical. This issue affects some unknown functionality of the component mail/mailx. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

mail and mailx in AIX 4.3.3 core dump when called with a very long argument, an indication of a buffer overflow.

The issue has been introduced in 09/01/1999. The weakness was shared 08/12/2002 (Website). The advisory is shared at archives.neohapsis.com. The identification of this vulnerability is CVE-2002-0743. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/14/2018). It is expected to see the exploit prices for this product decreasing in the near future.

The vulnerability was handled as a non-public zero-day exploit for at least 1076 days. During that time the estimated underground price was around $25k-$100k.

Upgrading to version 5.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (6181), SecurityFocus (BID 2457†) and Vulnerability Center (SBV-12752†). The entries VDB-18628, VDB-18630, VDB-18631 and VDB-18632 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• IBM

Name

• AIX

Version

• 4.3.3

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion