There is a buffer overflow vulnerability in the calendar daemon library libcsa.a. A remote attacker can exploit this vulnerability when the rpc.cmsd calendar daemon is enabled in /etc/inetd.conf.

The successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code as the root user.

The following libraries and executables are vulnerable :

/usr/dt/bin/rpc.cmsd /usr/dt/lib/libcsa.a.

There is a an error in the handling of the _LIB_INIT_DBG and
_LIB_INIT_DBG_FILE environment variables in a debugging component of the XL C++ runtime library. A local user can exploit this error when executing setuid root programs linked with the XL C++ runtime library, and thereby create arbirtrary, world writeable files owned by root.

The successful exploitation of this vulnerability allows a local user to create arbitrary files and execute arbitrary code as the root user.

Note that in AIX 6.1 the debugging component moved from libC.a to libc.a. This means that the fix is delivered by updating the XL C++ runtime on AIX 5.3 and earlier, and by updating the bos.rte.libc fileset on AIX 6.1.

The following libraries are vulnerable :

AIX 5.3 and earlier: /usr/lpp/xlC/lib/libC.a

AIX 6.1: /usr/ccs/lib/libc.a /usr/ccs/lib/libp/libc.a.

There is a buffer overflow vulnerability in the ToolTalk library libtt.a. A remote attacker can exploit this vulnerability when the rpc.ttdbserver is enabled in /etc/inetd.conf. 

The successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code as the root user.

The following libraries and executables are vulnerable :

/usr/dt/lib/libtt.a /usr/dt/bin/rpc.ttdbserver.

There is a race condition in the MALLOCDEBUG debugging component of the malloc subsystem in the library libc.a. A local user can exploit this race condition when executing setuid root programs and thereby overwrite any file in the system.

The successful exploitation of this vulnerability allows a local user to overwrite arbitrary files and execute arbitrary code as the root user.

The following libraries are vulnerable :

/usr/ccs/lib/libc.a /usr/ccs/lib/libp/libc.a.

The AIX kernel contains a buffer which can overflow. A local attacker may exploit this overflow to execute arbitrary code in kernel mode or create a denial of service by causing an unexpected system halt.

The following files are vulnerable :

/usr/lib/boot/unix_64 /usr/lib/boot/unix_mp /usr/lib/boot/unix_up.

There are multiple vulnerabilities in the AIX kernel :

a) A 64-bit process that is restarted via the checkpoint and restart feature will gain read and write access to certain areas of kernel memory, resulting in execution of arbitrary code. Track with the following APAR numbers: IZ16992, IZ17111, IZ11820, IZ12794. 

b) Remote nodes of a concurrent volume group may crash after a single node reduces the size of a JFS2 filesystem residing on the concurrent volume group, resulting in a denial of service. Track with the following APAR numbers: IZ05246, IZ04953, IZ04946.

c) The proc filesystem does not enforce directory access controls correctly when the permission on a directory is more restrictive than permission on the currently executing file in that directory, resulting in information leakage.
Track with the following APAR numbers: IZ06022, IZ06663, IZ06505.

d) Trusted Execution fails to protect files when the modifications are made via hard links. Affects AIX 6.1 only.
Track with the following APAR number: IZ13418

e) Some WPAR specific system calls may cause undefined behavior, possibly resulting in a denial of service. Affects AIX 6.1 only. Track with the following APAR numbers:
IZ13392, IZ13346

f) A user with enough privileges to run ProbeVue can read from any kernel memory address, resulting in information leakage. Affects AIX 6.1 only. Track with the following APAR number: IZ09545

The following files are vulnerable :

/usr/lib/boot/unix_64 /usr/lib/boot/unix_mp /usr/lib/boot/unix_up /usr/lib/drivers/hd_pin /usr/sbin/lreducelv

The fixes below include the fixes for all of the above APARs.

The nddstat family of commands contains an environment variable handling error. A local attacker may exploit this error to execute arbitrary code with root privileges because the commands are setuid root.

The following files are vulnerable :

/usr/sbin/atmstat /usr/sbin/entstat /usr/sbin/fddistat /usr/sbin/hdlcstat /usr/sbin/tokstat.

Buffer overflow vulnerabilities exist in the 'printers.rte' fileset commands listed below. A local attacker may execute arbitrary code with root privileges because the commands are setuid root.

The following commands are vulnerable :

/usr/lib/lpd/pio/etc/pioout The fix for piomkpq for IZ01121 and IZ01122 was not included with this fix package, therefore it has been repackged and included as described below. A local attacker who is a member of the printq group may execute arbitrary code with root privileges because the piomkpq command is setuid root. The following command is vulnerable: /usr/lib/lpd/pio/etc/piomkpq.

A buffer overflow vulnerability exists in the 'perl.rte' fileset. A remote attacker may execute arbitrary code if a Perl script executing on the system is listening on a network port. If exploited the attacker can execute arbitrary code with the same privileges as the script.

For more details please visit :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5116

The Digest module for Perl is prone to a vulnerability that will let attackers inject and execute arbitrary Perl code.

Remote attackers can exploit this issue to run arbitrary code in the context of the affected application.

Digest versions prior to 1.17 are affected.

For more details please visit :

http://www.securityfocus.com/bid/49911 https://secunia.com/advisories/46279

The security status of an NS RRset is not properly determined during a DNSKEY algorithm rollover which can allow a remote attacker to cause a denial of service.

Signed negative responses and corresponding RRSIG records in the cache are not properly handled which can allow a remote attacker to cause a denial of service.

After installing bos.rte.security 6.1.6.4 fileset, an LDAP user will be able to log in with an incorrect password. This occurs only when authtype is set to ldap_auth in the /etc/security/ldap/ldap.cfg file.
Non-LDAP users can also log in with incorrect passwords if the local users have their SYSTEM attribute in the /etc/security/user file is set to SYSTEM = 'LDAP', or the default stanza is set to SYSTEM = 'LDAP' and local users do not have SYSTEM set in their own stanza. If local users don't have LDAP in their SYSTEM attribute, then they will not be affected.

There is a buffer overflow vulnerability in the ftp server. By issuing an overly long NLST command, an attacker may cause a buffer overflow. 

The successful exploitation of this vulnerability allows a remote attacker to get the DES encrypted user hashes off the server if FTP is configured to allow write access using Anonymous account or another account that is available to the attacker.

The following executable is vulnerable :

/usr/sbin/ftpd.

ID	Name	Severity
64352	AIX 6.1 TL 3 : cmsd (IZ62572)	critical
64351	AIX 6.1 TL 2 : cmsd (IZ62571)	critical
64350	AIX 6.1 TL 1 : cmsd (IZ62570)	critical
64349	AIX 6.1 TL 0 : cmsd (IZ62569)	critical
64348	AIX 5.3 TL 8 : cmsd (IZ62237)	critical
64347	AIX 5.3 TL 10 : cmsd (IZ62123)	critical
64346	AIX 5.3 TL 9 : cmsd (IZ61717)	critical
64345	AIX 5.3 TL 7 : cmsd (IZ61628)	critical
64344	AIX 6.1 TL 3 : libC (IZ56206)	high
64343	AIX 6.1 TL 2 : libC (IZ56205)	high
64342	AIX 6.1 TL 1 : libC (IZ56204)	high
64341	AIX 6.1 TL 0 : libC (IZ56203)	high
64340	AIX 6.1 TL 3 : libtt (IZ52851)	high
64339	AIX 6.1 TL 2 : libtt (IZ52850)	high
64338	AIX 6.1 TL 1 : libtt (IZ52849)	high
64337	AIX 6.1 TL 0 : libtt (IZ52848)	high
64336	AIX 5.3 TL 9 : libtt (IZ52846)	high
64335	AIX 5.3 TL 8 : libtt (IZ52845)	high
64334	AIX 5.3 TL 7 : libtt (IZ52844)	high
64333	AIX 5.3 TL 0 : libtt (IZ52843)	high
64332	AIX 5.2 TL 0 : libtt (IZ52842)	high
64331	AIX 5.3 TL 7 : libc (IZ50517)	medium
64330	AIX 5.3 TL 0 : libc (IZ50500)	medium
64329	AIX 5.3 TL 8 : libc (IZ50447)	medium
64328	AIX 5.3 TL 9 : libc (IZ50445)	medium
64327	AIX 6.1 TL 0 : libc (IZ50139)	medium
64326	AIX 6.1 TL 1 : libc (IZ50129)	medium
64325	AIX 6.1 TL 2 : libc (IZ50121)	medium
64324	AIX 6.1 TL 0 : unix (IZ22370)	high
64323	AIX 5.3 TL 7 : unix (IZ22369)	high
64322	AIX 5.3 TL 0 : unix (IZ22368)	high
64321	AIX 5.3 TL 8 : unix (IZ21481)	high
64320	AIX 5.2 TL 0 : unix (IZ19911)	high
64319	AIX 5.3 TL 0 : kernel (IZ17111)	high
64318	AIX 5.3 TL 0 : nddstat (IZ17059)	high
64317	AIX 5.3 TL 0 : nddstat (IZ17058)	high
64316	AIX 5.2 TL 0 : kernel (IZ16992)	high
64315	AIX 5.2 TL 0 : nddstat (IZ16991)	high
64314	AIX 5.3 TL 7 : kernel (IZ11820)	high
64313	AIX 6.1 TL 0 : pioout (IZ10844)	high
64312	AIX 5.3 TL 7 : pioout (IZ10842)	high
64311	AIX 5.3 TL 0 : pioout (IZ10841)	high
64310	AIX 5.2 TL 0 : pioout (IZ10840)	high
64309	AIX 5.3 TL 5 : perl (IZ10244)	high
64299	AIX 5.3 TL 12 : perl (IV10197)	high
63827	AIX 5.3 TL 12 : bind9 (IZ99391)	medium
63826	AIX 6.1 TL 6 : ldapauth (IZ97416)	medium
63825	AIX 5.3 TL 12 : ftpd (IZ83276)	critical
63824	AIX 5.3 TL 11 : ftpd (IZ83275)	critical
63823	AIX 5.3 TL 10 : ftpd (IZ83274)	critical

Detections

Analytics

AIX Local Security Checks Family for Nessus

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

critical

critical

critical