CVE-2017-1093

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

IBM AIX 6.1, 7.1, and 7.2 could allow a local user to exploit a vulnerability in the bellmail binary to gain root privileges.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
IBM Corporation	AIX	3.4; 3.2.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; 4.2.0; 4.2.1.12; 430; 5; 5.1L; 5.2.2; 5.2 L; 5.3 L; 5.3.7; 4.3; 4.3.2; 4; 5.2

References

http://aix.software.ibm.com/aix/efixes/security/bellmail_advisory2.ascVendor Advisory
http://www.securityfocus.com/bid/95891Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037748
http://aix.software.ibm.com/aix/efixes/security/bellmail_advisory2.ascVendor Advisory
http://www.securityfocus.com/bid/95891Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037748

Timeline

Published: Feb 2, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-109309.8The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being a CVE-2017-109317.5The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to CVE-2017-109329.8All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 CVE-2017-109337.5All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulner CVE-2017-109349.8All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons Colle CVE-2017-109357.2All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password auth CVE-2017-109367.5SQL injection vulnerability in all versions prior to V4.01.01 of the ZTE ZXCDN-SNS product allows remote attackers to execute arbitrary SQL CVE-2017-109377.5SQL injection vulnerability in all versions prior to V2.01.05.09 of the ZTE ZXIPTV-UCM product allows remote attackers to execute arbitrary CVE-2017-109408.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agents CVE-2017-109418.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interacti CVE-2017-109426.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User i CVE-2017-109436.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User i