Insecure handling of the arguments to cdmount may allow a local regular user to execute commands as root. Cdmount allows regular users to mount CD-ROM drives in the AIX environment. The problem stems from the cvconnect command issued by the software and could allow users to overwrite any file on the system. Version 2.7 and higher correct the problem. Users with previous versions are urged to upgrade.
Users can also change the permissions for cvconnect to help alleviate the problem.
Patches are available. The original patch fixed a problem that could allow a malicious user to interfere with a digital content provider's ability to supply real-time audio and video broadcasts. Unfortunately, a regression in the patch opened up a new hole. Microsoft is urging users to reinstall this new patch . According to Red Hat Software, this new kernel release fixes a security hole that could affect any setuid program on the system.