Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2013-2989: IBM Sterling Connect:Direct on AIX lets local users read/write files

CVE-2013-2989 · published 13 years ago

Summary

The file‑copy feature in IBM Sterling Connect:Direct versions 3.8.00, 4.0.00 and 4.1.0 running on AIX 6.1‑7.1 does not set correct permissions. Because of this, someone who can log into the Connect:Direct program on the server can also access files they normally could not read or change. Apply the vendor’s patch or upgrade to a newer version as soon as possible to restore proper file protection.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	sterling_connect	3.8.00 4.0.00 4.1.0.0 `cpe:2.3:a:ibm:sterling_connect:3.8.00:::::::*`

Original advisory text

The file-copying functionality in IBM Sterling Connect:Direct 3.8.00, 4.0.00, and 4.1.0 for UNIX on AIX 6.1 through 7.1 uses incorrect privileges, which allows local users to bypass filesystem read permissions and write permissions by leveraging authentication to the Connect:Direct product.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

6.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-264Permissions, Privileges, and Access Controls

Timeline

Published28 May 2013

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2013-2989 · NVD

Track software like this

Free during beta