There is a buffer overflow vulnerability in the qosmod command. A locally authenticated attacker can exploit this vulnerability if they have they have been assigned the aix.network.config.no role-based access control authorization.

The successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with the innate privileges of the qosmod command.

The following executable is vulnerable :

/usr/sbin/qosmod.

There is a buffer overflow vulnerability in the qoslist command. A locally authenticated attacker can exploit this vulnerability if they have they have been assigned the aix.network.status or aix.network.config.no role-based access control authorizations.

The successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with the innate privileges of the qoslist command.

The following executable is vulnerable :

/usr/sbin/qoslist.

There is a buffer overflow vulnerability in the calendar daemon library libcsa.a. A remote attacker can exploit this vulnerability when the rpc.cmsd calendar daemon is enabled in /etc/inetd.conf.

The successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code as the root user.

The following libraries and executables are vulnerable :

/usr/dt/bin/rpc.cmsd /usr/dt/lib/libcsa.a.

There is a an error in the handling of the _LIB_INIT_DBG and
_LIB_INIT_DBG_FILE environment variables in a debugging component of the XL C++ runtime library. A local user can exploit this error when executing setuid root programs linked with the XL C++ runtime library, and thereby create arbirtrary, world writeable files owned by root.

The successful exploitation of this vulnerability allows a local user to create arbitrary files and execute arbitrary code as the root user.

Note that in AIX 6.1 the debugging component moved from libC.a to libc.a. This means that the fix is delivered by updating the XL C++ runtime on AIX 5.3 and earlier, and by updating the bos.rte.libc fileset on AIX 6.1.

The following libraries are vulnerable :

AIX 5.3 and earlier: /usr/lpp/xlC/lib/libC.a

AIX 6.1: /usr/ccs/lib/libc.a /usr/ccs/lib/libp/libc.a.

There is a buffer overflow vulnerability in the ToolTalk library libtt.a. A remote attacker can exploit this vulnerability when the rpc.ttdbserver is enabled in /etc/inetd.conf. 

The successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code as the root user.

The following libraries and executables are vulnerable :

/usr/dt/lib/libtt.a /usr/dt/bin/rpc.ttdbserver.

There is a race condition in the MALLOCDEBUG debugging component of the malloc subsystem in the library libc.a. A local user can exploit this race condition when executing setuid root programs and thereby overwrite any file in the system.

The successful exploitation of this vulnerability allows a local user to overwrite arbitrary files and execute arbitrary code as the root user.

The following libraries are vulnerable :

/usr/ccs/lib/libc.a /usr/ccs/lib/libp/libc.a.

The AIX kernel contains a buffer which can overflow. A local attacker may exploit this overflow to execute arbitrary code in kernel mode or create a denial of service by causing an unexpected system halt.

The following files are vulnerable :

/usr/lib/boot/unix_64 /usr/lib/boot/unix_mp /usr/lib/boot/unix_up.

There are multiple vulnerabilities in the AIX kernel :

a) A 64-bit process that is restarted via the checkpoint and restart feature will gain read and write access to certain areas of kernel memory, resulting in execution of arbitrary code. Track with the following APAR numbers: IZ16992, IZ17111, IZ11820, IZ12794. 

b) Remote nodes of a concurrent volume group may crash after a single node reduces the size of a JFS2 filesystem residing on the concurrent volume group, resulting in a denial of service. Track with the following APAR numbers: IZ05246, IZ04953, IZ04946.

c) The proc filesystem does not enforce directory access controls correctly when the permission on a directory is more restrictive than permission on the currently executing file in that directory, resulting in information leakage.
Track with the following APAR numbers: IZ06022, IZ06663, IZ06505.

d) Trusted Execution fails to protect files when the modifications are made via hard links. Affects AIX 6.1 only.
Track with the following APAR number: IZ13418

e) Some WPAR specific system calls may cause undefined behavior, possibly resulting in a denial of service. Affects AIX 6.1 only. Track with the following APAR numbers:
IZ13392, IZ13346

f) A user with enough privileges to run ProbeVue can read from any kernel memory address, resulting in information leakage. Affects AIX 6.1 only. Track with the following APAR number: IZ09545

The following files are vulnerable :

/usr/lib/boot/unix_64 /usr/lib/boot/unix_mp /usr/lib/boot/unix_up /usr/lib/drivers/hd_pin /usr/sbin/lreducelv

The fixes below include the fixes for all of the above APARs.

The nddstat family of commands contains an environment variable handling error. A local attacker may exploit this error to execute arbitrary code with root privileges because the commands are setuid root.

The following files are vulnerable :

/usr/sbin/atmstat /usr/sbin/entstat /usr/sbin/fddistat /usr/sbin/hdlcstat /usr/sbin/tokstat.

Buffer overflow vulnerabilities exist in the 'printers.rte' fileset commands listed below. A local attacker may execute arbitrary code with root privileges because the commands are setuid root.

The following commands are vulnerable :

/usr/lib/lpd/pio/etc/pioout The fix for piomkpq for IZ01121 and IZ01122 was not included with this fix package, therefore it has been repackged and included as described below. A local attacker who is a member of the printq group may execute arbitrary code with root privileges because the piomkpq command is setuid root. The following command is vulnerable: /usr/lib/lpd/pio/etc/piomkpq.

ID	Name	Severity
64360	AIX 6.1 TL 1 : qosmod (IZ71870)	high
64359	AIX 6.1 TL 1 : qoslist (IZ71869)	high
64358	AIX 6.1 TL 2 : qosmod (IZ71627)	high
64357	AIX 6.1 TL 2 : qoslist (IZ71590)	high
64356	AIX 6.1 TL 3 : qosmod (IZ71555)	high
64355	AIX 6.1 TL 3 : qoslist (IZ71554)	high
64354	AIX 6.1 TL 4 : qosmod (IZ68231)	high
64353	AIX 6.1 TL 4 : qoslist (IZ68194)	high
64352	AIX 6.1 TL 3 : cmsd (IZ62572)	critical
64351	AIX 6.1 TL 2 : cmsd (IZ62571)	critical
64350	AIX 6.1 TL 1 : cmsd (IZ62570)	critical
64349	AIX 6.1 TL 0 : cmsd (IZ62569)	critical
64348	AIX 5.3 TL 8 : cmsd (IZ62237)	critical
64347	AIX 5.3 TL 10 : cmsd (IZ62123)	critical
64346	AIX 5.3 TL 9 : cmsd (IZ61717)	critical
64345	AIX 5.3 TL 7 : cmsd (IZ61628)	critical
64344	AIX 6.1 TL 3 : libC (IZ56206)	high
64343	AIX 6.1 TL 2 : libC (IZ56205)	high
64342	AIX 6.1 TL 1 : libC (IZ56204)	high
64341	AIX 6.1 TL 0 : libC (IZ56203)	high
64340	AIX 6.1 TL 3 : libtt (IZ52851)	high
64339	AIX 6.1 TL 2 : libtt (IZ52850)	high
64338	AIX 6.1 TL 1 : libtt (IZ52849)	high
64337	AIX 6.1 TL 0 : libtt (IZ52848)	high
64336	AIX 5.3 TL 9 : libtt (IZ52846)	high
64335	AIX 5.3 TL 8 : libtt (IZ52845)	high
64334	AIX 5.3 TL 7 : libtt (IZ52844)	high
64333	AIX 5.3 TL 0 : libtt (IZ52843)	high
64332	AIX 5.2 TL 0 : libtt (IZ52842)	high
64331	AIX 5.3 TL 7 : libc (IZ50517)	medium
64330	AIX 5.3 TL 0 : libc (IZ50500)	medium
64329	AIX 5.3 TL 8 : libc (IZ50447)	medium
64328	AIX 5.3 TL 9 : libc (IZ50445)	medium
64327	AIX 6.1 TL 0 : libc (IZ50139)	medium
64326	AIX 6.1 TL 1 : libc (IZ50129)	medium
64325	AIX 6.1 TL 2 : libc (IZ50121)	medium
64324	AIX 6.1 TL 0 : unix (IZ22370)	high
64323	AIX 5.3 TL 7 : unix (IZ22369)	high
64322	AIX 5.3 TL 0 : unix (IZ22368)	high
64321	AIX 5.3 TL 8 : unix (IZ21481)	high
64320	AIX 5.2 TL 0 : unix (IZ19911)	high
64319	AIX 5.3 TL 0 : kernel (IZ17111)	high
64318	AIX 5.3 TL 0 : nddstat (IZ17059)	high
64317	AIX 5.3 TL 0 : nddstat (IZ17058)	high
64316	AIX 5.2 TL 0 : kernel (IZ16992)	high
64315	AIX 5.2 TL 0 : nddstat (IZ16991)	high
64314	AIX 5.3 TL 7 : kernel (IZ11820)	high
64313	AIX 6.1 TL 0 : pioout (IZ10844)	high
64312	AIX 5.3 TL 7 : pioout (IZ10842)	high
64311	AIX 5.3 TL 0 : pioout (IZ10841)	high

Detections

Analytics

AIX Local Security Checks Family for Nessus

high

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high