http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4788 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4788 IBM Power9 processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8616 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8616 ISC BIND is vulnerable to a denial of service, caused by the failure to limit the number of fetches performed when processing referrals. By using specially crafted referrals, a remote attacker could exploit this vulnerability to cause the recursing server to issue a very large number of fetches in an attempt to process the referral. ISC BIND is vulnerable to a denial of service, caused by a logic error in code which checks TSIG validity. A remote attacker could exploit this vulnerability to trigger an assertion failure in tsig.c.

The remote AIX host has a version of OpenSSH installed that is affected by a vulnerability that allows a remote attacker to obtain sensitive information, caused by different responses to valid and invalid authentication attempts. By sending a specially crafted request, an attacker could exploit this vulnerability to enumerate valid usernames.

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :

  - OpenSSH is vulnerable to a denial of service, caused by     an error in the kex_input_kexinit() function. By     sending specially crafted data during the key exchange     process, a remote attacker could exploit this     vulnerability to consume all available memory resources.
    (CVE-2016-8858)

  - OpenSSH could allow a remote authenticated attacker to     execute arbitrary code on the system, caused by the     loading of a specially crafted PKCS#11 module across a     forwarded agent channel. An attacker could exploit this     vulnerability to write files or execute arbitrary code     on the system. (CVE-2016-10009)

  - OpenSSH could allow a local authenticated attacker to     obtain sensitive information, caused by a privilege     separation flaw. An attacker could exploit this     vulnerability to obtain host private key material and     other sensitive information. (CVE-2016-10011)

  - OpenSSH could allow a local attacker to gain elevated     privileges on the system, caused by improper bounds     checking in the shared memory manager. An attacker     could exploit this vulnerability to gain elevated     privileges on the system. (CVE-2016-10012)

The version of OpenSSH installed on the remote AIX host is affected by a vulnerability in the process_open function of sftp-server.c in OpenSSH in that it does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14467 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14467 The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP). The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print(). The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs(). The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2(). tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2). The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print(). tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).
Tcpdump is vulnerable to a buffer overflow, caused by improper bounds checking by the lmp_print_data_link_subobjs function in print-lmp.c.
By sending specially-crafted data, a remote attacker could overflow a buffer and cause the application to crash. The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert(). The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print(). The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print(). The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART). The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print(). The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr(). The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print(). The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN. The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion. The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI). lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks. The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file(). The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix(). The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option(). The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield. The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion. The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c. tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - A flaw exists in Libraries that allows an unauthenticated, remote    attacker to cause denial of service. (CVE-2019-2602)

  - A flaw exists in the RMI component that allows an unauthenticated,     remote attacker to cause unspecified integrity impact.
    (CVE-2019-2684)

  - Flaws exist in the 2D component that allows an unauthenticated,     remote attacker to take control of the system via unspecified     means. (CVE-2019-2697, CVE-2019-2698)

  - A flaw exists in Eclipse OpenJ9 that allows an unauthenticated,     remote attacker to cause denial of service. (CVE-2019-10245)

The version of OpenSSL installed on the remote AIX host is affected by a side channel attack information disclosure vulnerability.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19519 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19519 Tcpdump is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the print_prefix function of print-hncp.c. By using a specially-crafted packet data, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14665 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14665 X.Org X server could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper validation of command line parameters. An attacker could exploit this vulnerability using the -modulepath argument or the -logfile argument to overwrite arbitrary files and execute unprivileged code on the system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3623 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3623 An unspecified vulnerability in Oracle Sun Systems related to the Solaris Kernel RPC component could allow an unauthenticated attacker to take control of the system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6922 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6922 FreeBSD is vulnerable to a denial of service, caused by the use of an inefficient TCP reassembly algorithm. By sending specially-crafted TCP traffic, a remote attacker could exploit this vulnerability to consume all available CPU resources.

The version of restbyinode installed on the remote AIX host is affected by a privilege escalation vulnerability. A local attacker can exploit this to gain root privileges.

The version of lquerypv installed on the remote AIX host is affected by a privilege escalation vulnerability. A local attacker can exploit this to gain root privileges.

The version of bos_acct installed on the remote AIX host is affected by a privilege escalation vulnerability. A local attacker can exploit this to gain root privileges.

ID	Name	Severity
143147	AIX 7.2 TL 4 : power9 (IJ28227)	High
143142	AIX 7.1 TL 5 : power9 (IJ28229)	High
143136	AIX 7.2 TL 5 : power9 (IJ28226)	High
143131	AIX 7.2 TL 3 : power9 (IJ28228)	High
139755	AIX 7.2 TL 4 : bind (IJ25927)	Medium
139754	AIX 7.2 TL 3 : bind (IJ25926)	Medium
139753	AIX 7.2 TL 2 : bind (IJ25925)	Medium
139752	AIX 7.1 TL 5 : bind (IJ25924)	Medium
136325	AIX OpenSSH Advisory : openssh_advisory12.asc	Medium
136324	AIX OpenSSH Advisory : openssh_advisory10.asc	High
136323	AIX OpenSSH Advisory : openssh_advisory11.asc	Medium
132733	AIX 7.2 TL 4 : tcpdump (IJ20786)	High
132732	AIX 7.2 TL 3 : tcpdump (IJ20785)	High
132731	AIX 7.2 TL 2 : tcpdump (IJ20784)	High
132730	AIX 7.1 TL 5 : tcpdump (IJ20783)	High
126924	AIX Java Advisory : java_apr2019_advisory.asc (April 2019 CPU)	Medium
125708	AIX OpenSSL Advisory : openssl_advisory30.asc	Medium
125707	AIX OpenSSL Advisory : openssl_advisory29.asc	Medium
122429	AIX 7.2 TL 3 : tcpdump (IJ12983)	Medium
122428	AIX 7.2 TL 2 : tcpdump (IJ12982)	Medium
122427	AIX 7.2 TL 1 : tcpdump (IJ12981)	Medium
122426	AIX 7.1 TL 5 : tcpdump (IJ12980)	Medium
122425	AIX 7.1 TL 4 : tcpdump (IJ12979)	Medium
119633	AIX 5.3 TL 12 : xorg (IJ11551)	High
119632	AIX 7.2 TL 3 : xorg (IJ11550)	High
119631	AIX 7.2 TL 2 : xorg (IJ11549)	High
119630	AIX 7.2 TL 1 : xorg (IJ11547)	High
119629	AIX 7.2 TL 0 : xorg (IJ11546)	High
119628	AIX 7.1 TL 5 : xorg (IJ11545)	High
119627	AIX 7.1 TL 4 : xorg (IJ11544)	High
119626	AIX 6.1 TL 9 : xorg (IJ11000)	High
119625	AIX 5.3 TL 12 : solaris (IJ10554)	Critical
119624	AIX 7.2 TL 0 : solaris (IJ10553)	Critical
119623	AIX 7.2 TL 1 : solaris (IJ10552)	Critical
119622	AIX 7.1 TL 4 : solaris (IJ10275)	Critical
119621	AIX 6.1 TL 9 : solaris (IJ10134)	Critical
119620	AIX 7.1 TL 5 : solaris (IJ10132)	Critical
119619	AIX 7.2 TL 2 : solaris (IJ10130)	Critical
119618	AIX 7.2 TL 3 : solaris (IJ09805)	Critical
118831	AIX 7.2 TL 3 : freebsd (IJ09625)	Medium
118830	AIX 7.2 TL 2 : freebsd (IJ09624)	Medium
118829	AIX 7.2 TL 1 : freebsd (IJ09623)	Medium
118828	AIX 7.2 TL 0 : freebsd (IJ09622)	Medium
118827	AIX 7.1 TL 5 : freebsd (IJ09621)	Medium
118826	AIX 7.1 TL 4 : freebsd (IJ09620)	Medium
118825	AIX 6.1 TL 9 : freebsd (IJ09619)	Medium
118824	AIX 5.3 TL 12 : freebsd (IJ09618)	Medium
111972	AIX restbyinode Advisory : suid_advisory.asc (IV97852) (IV97957) (IV97958) (IV97959) (IV98013)	High
111971	AIX lquerypv Advisory : suid_advisory.asc (IJ00951) (IV99548) (IV99550) (IV99551) (IV99552)	High
111970	AIX bos.acct Advisory : suid_advisory.asc (IV97810) (IV97811) (IV97896) (IV97897) (IV97898) (IV97899) (IV97900) (IV97901)	High

AIX Local Security Checks Family for Nessus