Information disclosure in IBM AIX

1) Information disclosure

EUVDB-ID: #VU643

Risk: Low

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2016-6038

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to obtain potentially sensitive information on the target system.
The weakness exists due to directory traversal flaw. By submission of specially crafted URL attackers can easily view arbitrary files.
Successfull exploitation of the vulnerability may result in information disclosure on the vulnerable system.

Mitigation

No solution resolving the vulnerability is available.

Vulnerable software versions

IBM AIX: 5.3 - 7.1

External links

http://aix.software.ibm.com/aix/efixes/security/pconsole_mitigation.asc

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.