The AIX kernel contains a buffer which can overflow. A local attacker may exploit this overflow to execute arbitrary code in kernel mode or create a denial of service by causing an unexpected system halt.

The following files are vulnerable :

/usr/lib/boot/unix_64 /usr/lib/boot/unix_mp /usr/lib/boot/unix_up.

There are multiple vulnerabilities in the AIX kernel :

a) A 64-bit process that is restarted via the checkpoint and restart feature will gain read and write access to certain areas of kernel memory, resulting in execution of arbitrary code. Track with the following APAR numbers: IZ16992, IZ17111, IZ11820, IZ12794. 

b) Remote nodes of a concurrent volume group may crash after a single node reduces the size of a JFS2 filesystem residing on the concurrent volume group, resulting in a denial of service. Track with the following APAR numbers: IZ05246, IZ04953, IZ04946.

c) The proc filesystem does not enforce directory access controls correctly when the permission on a directory is more restrictive than permission on the currently executing file in that directory, resulting in information leakage.
Track with the following APAR numbers: IZ06022, IZ06663, IZ06505.

d) Trusted Execution fails to protect files when the modifications are made via hard links. Affects AIX 6.1 only.
Track with the following APAR number: IZ13418

e) Some WPAR specific system calls may cause undefined behavior, possibly resulting in a denial of service. Affects AIX 6.1 only. Track with the following APAR numbers:
IZ13392, IZ13346

f) A user with enough privileges to run ProbeVue can read from any kernel memory address, resulting in information leakage. Affects AIX 6.1 only. Track with the following APAR number: IZ09545

The following files are vulnerable :

/usr/lib/boot/unix_64 /usr/lib/boot/unix_mp /usr/lib/boot/unix_up /usr/lib/drivers/hd_pin /usr/sbin/lreducelv

The fixes below include the fixes for all of the above APARs.

The nddstat family of commands contains an environment variable handling error. A local attacker may exploit this error to execute arbitrary code with root privileges because the commands are setuid root.

The following files are vulnerable :

/usr/sbin/atmstat /usr/sbin/entstat /usr/sbin/fddistat /usr/sbin/hdlcstat /usr/sbin/tokstat.

Buffer overflow vulnerabilities exist in the 'printers.rte' fileset commands listed below. A local attacker may execute arbitrary code with root privileges because the commands are setuid root.

The following commands are vulnerable :

/usr/lib/lpd/pio/etc/pioout The fix for piomkpq for IZ01121 and IZ01122 was not included with this fix package, therefore it has been repackged and included as described below. A local attacker who is a member of the printq group may execute arbitrary code with root privileges because the piomkpq command is setuid root. The following command is vulnerable: /usr/lib/lpd/pio/etc/piomkpq.

A buffer overflow vulnerability exists in the 'perl.rte' fileset. A remote attacker may execute arbitrary code if a Perl script executing on the system is listening on a network port. If exploited the attacker can execute arbitrary code with the same privileges as the script.

For more details please visit :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5116

The Digest module for Perl is prone to a vulnerability that will let attackers inject and execute arbitrary Perl code.

Remote attackers can exploit this issue to run arbitrary code in the context of the affected application.

Digest versions prior to 1.17 are affected.

For more details please visit :

http://www.securityfocus.com/bid/49911 https://secunia.com/advisories/46279

The security status of an NS RRset is not properly determined during a DNSKEY algorithm rollover which can allow a remote attacker to cause a denial of service.

Signed negative responses and corresponding RRSIG records in the cache are not properly handled which can allow a remote attacker to cause a denial of service.

After installing bos.rte.security 6.1.6.4 fileset, an LDAP user will be able to log in with an incorrect password. This occurs only when authtype is set to ldap_auth in the /etc/security/ldap/ldap.cfg file.
Non-LDAP users can also log in with incorrect passwords if the local users have their SYSTEM attribute in the /etc/security/user file is set to SYSTEM = 'LDAP', or the default stanza is set to SYSTEM = 'LDAP' and local users do not have SYSTEM set in their own stanza. If local users don't have LDAP in their SYSTEM attribute, then they will not be affected.

There is a buffer overflow vulnerability in the ftp server. By issuing an overly long NLST command, an attacker may cause a buffer overflow. 

The successful exploitation of this vulnerability allows a remote attacker to get the DES encrypted user hashes off the server if FTP is configured to allow write access using Anonymous account or another account that is available to the attacker.

The following executable is vulnerable :

/usr/sbin/ftpd.

'An integer overflow vulnerability was reported in the rpc.pcnfsd service within the several systems. The rpc.pcnfsd daemon handles requests from PC-NFS clients for authentication services on remote machines. These services include authentication for mounting and for print spooling. The vulnerability is triggered when parsing crafted RPC requests. A remote attacker can leverage this vulnerability by sending a crafted RPC message to the target host, to potentially inject and execute arbitrary code.'.

'sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.'.

'NTP mode 7 (MODE_PRIVATE) is used by the ntpdc query and control utility. In contrast, ntpq uses NTP mode 6 (MODE_CONTROL), while routine NTP time transfers use modes 1 through 5. Upon receipt of an incorrect mode 7 request or a mode 7 error response from an address that is not listed in a 'restrict ... noquery' or 'restrict ...
ignore' segment, ntpd will reply with a mode 7 error response and log a message.'

'If an attacker spoofs the source address of ntpd host A in a mode 7 response packet sent to ntpd host B, both A and B will continuously send each other error responses, for as long as those packets get through.'

'If an attacker spoofs an address of ntpd host A in a mode 7 response packet sent to ntpd host A, then host A will respond to itself endlessly, consuming CPU and logging excessively.'.

AIX 'named' is an implementation of BIND (Berkeley Internet Name Domain) providing server functionality for the Domain Name System (DNS) Protocol. AIX currently ships and supports three versions of BIND: 4, 8, and 9.

There is an error in the handling of dynamic update messages in BIND 9. A crafted update packet from a remote user can cause a master server to assert and exit. The successful exploitation of this vulnerability allows a remote, unauthenticated user to make a master DNS server assert and exit.

The following command is vulnerable :

/usr/sbin/named9.

ID	Name	Severity
64322	AIX 5.3 TL 0 : unix (IZ22368)	high
64321	AIX 5.3 TL 8 : unix (IZ21481)	high
64320	AIX 5.2 TL 0 : unix (IZ19911)	high
64319	AIX 5.3 TL 0 : kernel (IZ17111)	high
64318	AIX 5.3 TL 0 : nddstat (IZ17059)	high
64317	AIX 5.3 TL 0 : nddstat (IZ17058)	high
64316	AIX 5.2 TL 0 : kernel (IZ16992)	high
64315	AIX 5.2 TL 0 : nddstat (IZ16991)	high
64314	AIX 5.3 TL 7 : kernel (IZ11820)	high
64313	AIX 6.1 TL 0 : pioout (IZ10844)	high
64312	AIX 5.3 TL 7 : pioout (IZ10842)	high
64311	AIX 5.3 TL 0 : pioout (IZ10841)	high
64310	AIX 5.2 TL 0 : pioout (IZ10840)	high
64309	AIX 5.3 TL 5 : perl (IZ10244)	high
64299	AIX 5.3 TL 12 : perl (IV10197)	high
63827	AIX 5.3 TL 12 : bind9 (IZ99391)	medium
63826	AIX 6.1 TL 6 : ldapauth (IZ97416)	medium
63825	AIX 5.3 TL 12 : ftpd (IZ83276)	critical
63824	AIX 5.3 TL 11 : ftpd (IZ83275)	critical
63823	AIX 5.3 TL 10 : ftpd (IZ83274)	critical
63822	AIX 5.3 TL 9 : ftpd (IZ83252)	critical
63821	AIX 6.1 TL 2 : pcnfsd (IZ75465)	critical
63820	AIX 6.1 TL 3 : pcnfsd (IZ75440)	critical
63819	AIX 6.1 TL 4 : pcnfsd (IZ75369)	critical
63818	AIX 5.3 TL 9 : pcnfsd (IZ73874)	critical
63817	AIX 5.3 TL 10 : pcnfsd (IZ73757)	critical
63816	AIX 5.3 TL 11 : pcnfsd (IZ73681)	critical
63815	AIX 6.1 TL 5 : pcnfsd (IZ73599)	critical
63814	AIX 5.3 TL 12 : pcnfsd (IZ73590)	critical
63813	AIX 5.3 TL 11 : sendmail (IZ72837)	high
63812	AIX 5.3 TL 10 : sendmail (IZ72836)	high
63811	AIX 5.3 TL 9 : sendmail (IZ72835)	high
63810	AIX 5.3 TL 8 : sendmail (IZ72834)	high
63809	AIX 6.1 TL 1 : sendmail (IZ72528)	high
63808	AIX 6.1 TL 2 : sendmail (IZ72515)	high
63807	AIX 6.1 TL 3 : sendmail (IZ72510)	high
63806	AIX 6.1 TL 3 : xntpd (IZ71614)	medium
63805	AIX 6.1 TL 2 : xntpd (IZ71613)	medium
63804	AIX 6.1 TL 1 : xntpd (IZ71611)	medium
63803	AIX 5.3 TL 11 : xntpd (IZ71610)	medium
63802	AIX 5.3 TL 10 : xntpd (IZ71608)	medium
63801	AIX 5.3 TL 9 : xntpd (IZ71093)	medium
63800	AIX 6.1 TL 4 : xntpd (IZ71071)	medium
63799	AIX 6.1 TL 4 : sendmail (IZ70637)	high
63798	AIX 5.3 TL 8 : xntpd (IZ68659)	medium
63797	AIX 6.1 TL 3 : bind (IZ56318)	medium
63796	AIX 6.1 TL 2 : bind (IZ56317)	medium
63795	AIX 6.1 TL 1 : bind (IZ56316)	medium
63794	AIX 6.1 TL 0 : bind (IZ56315)	medium
63793	AIX 5.3 TL 10 : bind (IZ56314)	medium

Detections

Analytics

AIX Local Security Checks Family for Nessus

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium