CVE-2014-0899 - Vulnerability Details - OpenCVE

ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00297.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Aix

Configuration 1 [-]

OR	cpe:2.3:o:ibm:aix:7.1.1:::::::*
	cpe:2.3:o:ibm:aix:7.1.2:::::::*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc
http://www.ibm.com/support/docview.wss?uid=isg1IV51420
http://www.ibm.com/support/docview.wss?uid=isg1IV51421
https://exchange.xforce.ibmcloud.com/vulnerabilities/91396

History

No history.

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2014-03-11T01:00:00

Updated: 2024-08-06T09:27:20.275Z

Reserved: 2014-01-06T00:00:00

Link: CVE-2014-0899

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-03-11T13:01:09.607

Modified: 2025-04-12T10:46:40.837

Link: CVE-2014-0899

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-03-06T00:00:00", "descriptions": [{"lang": "en", "value": "ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc"}, {"name": "IV51420", "tags": ["vendor-advisory", "x_refsource_AIXAPAR"], "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51420"}, {"name": "ibm-aix-wpar-ftpd(91396)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91396"}, {"name": "IV51421", "tags": ["vendor-advisory", "x_refsource_AIXAPAR"], "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51421"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2014-0899", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc", "refsource": "CONFIRM", "url": "http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc"}, {"name": "IV51420", "refsource": "AIXAPAR", "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51420"}, {"name": "ibm-aix-wpar-ftpd(91396)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91396"}, {"name": "IV51421", "refsource": "AIXAPAR", "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51421"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:27:20.275Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc"}, {"name": "IV51420", "tags": ["vendor-advisory", "x_refsource_AIXAPAR", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51420"}, {"name": "ibm-aix-wpar-ftpd(91396)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91396"}, {"name": "IV51421", "tags": ["vendor-advisory", "x_refsource_AIXAPAR", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51421"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2014-0899", "datePublished": "2014-03-11T01:00:00", "dateReserved": "2014-01-06T00:00:00", "dateUpdated": "2024-08-06T09:27:20.275Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:aix:7.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "BCD291BF-3E5F-420B-B269-B7CE6C5B7A3F", "vulnerable": true}, {"criteria": "cpe:2.3:o:ibm:aix:7.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "DE63FAB0-DE3F-4F64-A9A1-1B6190CF7A4B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands."}, {"lang": "es", "value": "ftpd en IBM AIX 7.1.1 anterior a SP10 y 7.1.2 anterior a SP5, cuando un Workload Partition (tambi\u00e9n conocido como WPAR) para AIX 5.2 o 5.3 es utilizado, permite a usuarios remotos autenticados evadir configuraciones de permiso y modificar archivos arbitrarios a trav\u00e9s de comandos FTP."}], "id": "CVE-2014-0899", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-03-11T13:01:09.607", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc"}, {"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51420"}, {"source": "psirt@us.ibm.com", "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51421"}, {"source": "psirt@us.ibm.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91396"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://aix.software.ibm.com/aix/efixes/security/wparcre_advisory.asc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51420"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ibm.com/support/docview.wss?uid=isg1IV51421"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91396"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}