The version of OpenSSL installed on the remote AIX host is affected by multiple vulnerabilities :

  - A NULL pointer dereference flaw exists in file     rsa_ameth.c when handling ASN.1 signatures that use the     RSA PSS algorithm but are missing a mask generation     function parameter. A remote attacker can exploit this     to cause the signature verification routine to crash,     leading to a denial of service. (CVE-2015-3194)

  - A flaw exists in the ASN1_TFLG_COMBINE implementation in     file tasn_dec.c related to handling malformed     X509_ATTRIBUTE structures. A remote attacker can exploit     this to cause a memory leak by triggering a decoding     failure in a PKCS#7 or CMS application, resulting in a     denial of service. (CVE-2015-3195)

  - A race condition exists in s3_clnt.c that is triggered     when PSK identity hints are incorrectly updated in the     parent SSL_CTX structure when they are received by a     multi-threaded client. A remote attacker can exploit     this, via a crafted ServerKeyExchange message, to cause     a double-free memory error, resulting in a denial of     service. (CVE-2015-3196)

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following components :

  - 2D
  - CORBA
  - Deployment
  - JAXP
  - JGSS
  - Libraries
  - RMI
  - Security
  - Serialization

The remote host is missing AIX PTF U863668, which is related to the security of the package bos.net.tcp.server.

Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.

The remote host is missing AIX PTF U861500, which is related to the security of the package bos.net.tcp.client.

Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.

Network Time Protocol (NTP) Project NTP daemon (ntpd) is vulnerable to a denial of service, caused by an error when using symmetric key authentication. By sending specially crafted packets to both peering hosts, an attacker could exploit this vulnerability to prevent synchronization.

The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHE_EXPORT ciphersuite choice. An attacker could exploit this vulnerability using man-in-the-middle techniques to force a downgrade to 512-bit export-grade cipher. Successful exploitation could allow an attacker to recover the session key as well as modify the contents of the traffic. This vulnerability is commonly referred to as 'Logjam'.

ISC BIND is vulnerable to a denial of service, caused by an error in the handling of TKEY queries. By sending specially crafted packets, a remote attacker could exploit this vulnerability to cause a REQUIRE assertion failure.

IBM AIX could allow a local attacker to escalate their privileges to root access through a vulnerability in netstat when a fiber channel adapter is present.

ISC BIND is vulnerable to a denial of service, caused by the exit of a validating resolver due to an assertion failure in buffer.c. By parsing a malformed DNSSEC key, a remote attacker could exploit this vulnerability to cause a denial of service.

ISC BIND is vulnerable to a denial of service, caused by the exit of a validating resolver due to an assertion failure in buffer.c. By parsing a malformed DNSSEC key, a remote attacker could exploit this vulnerability to cause a denial of service.

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :

  - A flaw exists in the monitor component when handling     extraneous username data in MONITOR_REQ_PAM_INIT_CTX     requests. A local attacker can exploit this issue to     conduct an impersonation attack, by sending a crafted     MONITOR_REQ_PWNAM request that leverages any SSH login     access with control of the sshd UID. (CVE-2015-6563)

  - A use-after-free error exists in function     mm_answer_pam_free_ctx() in the file monitor.c when     handling MONITOR_REQ_PAM_FREE_CTX requests. A local     attacker can exploit this to gain elevated privileges,     by leveraging control of the sshd UID to send an     unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
    (CVE-2015-6564)

IBM AIX could allow a local attacker to escalate their privileges to root access through a vulnerability in netstat when a fiber channel adapter is present.

The remote host is missing AIX PTF U867549, which is related to the security of the package bos.rte.lvm.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The remote host is missing AIX PTF U868378, which is related to the security of the package bos.rte.lvm.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The version of OpenSSH running on the remote host is affected by a security bypass vulnerability due to a failure to check the refusal deadline during the forwarding of untrusted X11 connections. A remote attacker can exploit this to bypass timeout checks and XSECURITY restrictions.

Network Time Protocol (NTP) Project NTP daemon (ntpd) is vulnerable to a denial of service, caused by an error when using symmetric key authentication. By sending specially-crafted packets to both peering hosts, an attacker could exploit this vulnerability to prevent synchronization.

The remote AIX host has a version of Network Time Protocol (NTP) installed that is affected by a denial of service vulnerability due to a flaw in the symmetric-key feature in the receive() function in file ntp_proto.c when receiving certain invalid packets, which causes state-variable updates to be performed. A man-in-the-middle attacker can exploit this, by spoofing the source IP of a peer, to cause a synchronization loss.

The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHE_EXPORT ciphersuite choice. An attacker could exploit this vulnerability using man-in-the-middle techniques to force a downgrade to 512-bit export-grade cipher. Successful exploitation could allow an attacker to recover the session key as well as modify the contents of the traffic. This vulnerability is commonly referred to as 'Logjam'.

ISC BIND is vulnerable to a denial of service, caused by an error in the handling of TKEY queries. By sending specially-crafted packets, a remote attacker could exploit this vulnerability to cause a REQUIRE assertion failure.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities :

  - Java Security Components store plaintext data in memory     dumps, which allows a local attacker to gain access to     sensitive information. (CVE-2015-1931)

  - A flaw exists in the readSerialData() function in     class ObjectInputStream.java when handling OIS data,     which allows an attacker to execute arbitrary code.
    (CVE-2015-2590)

  - Multiple flaws exist in the JCE component due to     various cryptographic operations using non-constant     time comparisons. A remote attacker can exploit this     to conduct timing attacks to gain access to sensitive     information. (CVE-2015-2601)

  - A flaw exists in the ECDH_Derive() function in file     ec.c due to missing EC parameter validation when     performing ECDH key derivation. A remote attacker can     exploit this to access sensitive information.
    (CVE-2015-2613)

  - An unspecified vulnerability exists in the 2D component     that allows a remote attacker to access sensitive     information. (CVE-2015-2619, CVE-2015-2637)

  - A flaw exists in the RMIConnectionImpl constructor     in class RMIConnectionImpl.java due to improper     permission checks when creating repository class     loaders. An attacker can exploit this to bypass sandbox     restrictions and access sensitive information.
    (CVE-2015-2621)

  - An unspecified flaw exists in the JSSE component when     handling the SSL/TLS protocol. A remote attacker can     exploit this to gain access to sensitive information.
    (CVE-2015-2625)

  - An integer overflow condition exists in the     International Components for Unicode for C/C++ (ICU4C).
    An attacker, using a specially crafted font, can exploit     this to crash an application using this library or     access memory contents. (CVE-2015-2632)

  - A unspecified vulnerability exists in the 2D component     that allows a remote attacker to execute arbitrary     code. (CVE-2015-2638)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to gain elevated     privileges. (CVE-2015-2664)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

  - An unspecified vulnerability exists in the Deployment     component that impacts confidentiality and integrity.
    (CVE-2015-4729)

  - A flaw exists in class MBeanServerInvocationHandler.java     when handling MBean connection proxy classes. An     attacker can exploit this to bypass sandbox restrictions     and execute arbitrary code. (CVE-2015-4731)

  - Multiple flaws exist in classes ObjectInputStream.java     and SerialCallbackContext.java related to insufficient     context checking. An attacker can exploit these to     execute arbitrary code. (CVE-2015-4732)

  - A flaw exists in the invoke() method in the class     RemoteObjectInvocationHandler.java due to calls to the     finalize() method being permitted. An attacker can     exploit this to bypass sandbox protections and execute     arbitrary code. (CVE-2015-4733)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to execute arbitrary code.
    (CVE-2015-4736)

  - A flaw exists in the Security component when handling     Online Certificate Status Protocol (OCSP) responses with     no 'nextUpdate'. A remote attacker can exploit this to     cause an application to accept a revoked X.509     certificate. (CVE-2015-4748)

  - An flaw exists in the query() method in class     DnsClient.java due to a failure by the JNDI component's     exception handling to release request information. A     remote attacker can exploit this to cause a denial of     service. (CVE-2015-4749)

  - An integer overflow condition exists in the layout     engine in the International Components for Unicode for     C/C++ (ICU4C). An attacker, using a specially crafted     font, can exploit this to crash an application using     this library or execute arbitrary code. (CVE-2015-4760)

The version of OpenSSL installed on the remote AIX host is affected by multiple vulnerabilities :

  - An invalid free memory error exists due to improper     validation of user-supplied input when a DTLS peer     receives application data between ChangeCipherSpec and     Finished messages. A remote attacker can exploit this to     corrupt memory, resulting in a denial of service or     the execution of arbitrary code. (CVE-2014-8176)

  - A denial of service vulnerability exists when processing     an ECParameters structure due to an infinite loop that     occurs when a specified curve is over a malformed binary     polynomial field. A remote attacker can exploit this to     perform a denial of service against any system that     processes public keys, certificate requests, or     certificates. This includes TLS clients and TLS servers     with client authentication enabled. (CVE-2015-1788)

  - A denial of service vulnerability exists due to improper     validation of the content and length of the ASN1_TIME     string by the X509_cmp_time() function. A remote     attacker can exploit this, via a malformed certificate     and CRLs of various sizes, to cause a segmentation     fault, resulting in a denial of service condition. TLS     clients that verify CRLs are affected. TLS clients and     servers with client authentication enabled may be     affected if they use custom verification callbacks.
    (CVE-2015-1789)

  - A NULL pointer dereference flaw exists in the PKCS#7     parsing code due to incorrect handling of missing inner     'EncryptedContent'. This allows a remote attacker, via     specially crafted ASN.1-encoded PKCS#7 blobs with     missing content, to cause a denial of service condition     or other potential unspecified impacts. (CVE-2015-1790)

  - A double-free error exists due to a race condition that     occurs when a NewSessionTicket is received by a     multi-threaded client when attempting to reuse a     previous ticket. (CVE-2015-1791)

  - A denial of service vulnerability exists in the CMS code     due to an infinite loop that occurs when verifying a     signedData message. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-1792)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9297 Network Time Protocol (NTP) Project NTP daemon (ntpd) could allow a remote attacker to conduct spoofing attacks, caused by insufficient entropy in PRNG. An attacker could exploit this vulnerability to spoof the IPv6 address ::1 to bypass ACLs and launch further attacks on the system. Network Time Protocol (NTP) Project NTP daemon (ntpd) is vulnerable to a denial of service, caused by an error when using symmetric key authentication. By sending specially-crafted packets to both peering hosts, an attacker could exploit this vulnerability to prevent synchronization.

A man-in-the-middle (MitM) information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. A MitM attacker can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities :

  - The Global Security Kit (GSKit) contains a flaw due to     improper restrictions of TLS state transitions. A     man-in-the-middle attacker can exploit this to downgrade     the security of a session to use EXPORT_RSA ciphers.
    This allows the attacker to more easily break the     encryption and monitor or tamper with the encrypted     stream. (CVE-2015-0138)

  - An unspecified flaw exists that allows an attacker to     execute code running under a security manager with     elevated privileges.(CVE-2015-0192)

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to the     support of weak EXPORT_RSA cipher suites with keys less     than or equal to 512 bits. A man-in-the-middle attacker     may be able to downgrade the SSL/TLS connection to use     EXPORT_RSA cipher suites which can be factored in a     short amount of time, allowing the attacker to intercept     and decrypt the traffic. (CVE-2015-0204)

  - Multiple unspecified vulnerabilities exist in multiple     Java subcomponents including 2D, Beans, Deployment, JCE,     JSSE, and tools. (CVE-2015-0458, CVE-2015-0459,     CVE-2015-0469, CVE-2015-0477, CVE-2015-0478,     CVE-2015-0480, CVE-2015-0486, CVE-2015-0488,     CVE-2015-0491)

  - An unspecified flaw exists that allows a remote attacker     to bypass permission checks and gain access to sensitive     information. (CVE-2015-1914)

  - An unspecified flaw exists due to the Socket Extension     Provider's handling of TLS and SSL connections. A remote     attacker can exploit this to cause a denial of service.
    (CVE-2015-1916)

  - A security feature bypass vulnerability exists, known as     Bar Mitzvah, due to improper combination of state data     with key data by the RC4 cipher algorithm during the     initialization phase. A man-in-the-middle attacker can     exploit this, via a brute-force attack using LSB values,     to decrypt the traffic. (CVE-2015-2808)

The remote host is missing AIX PTF U865862, which is related to the security of the package bos.rte.lvm.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

ID	Name	Severity
88085	AIX OpenSSL Advisory : openssl_advisory15.asc	medium
87374	AIX Java Advisory : java_oct2015_advisory.asc (October 2015 CPU)	critical
87185	AIX 6.1 TL 9 : bos.net.tcp.server (U863668) (Bar Mitzvah)	medium
87184	AIX 6.1 TL 9 : bos.net.tcp.client (U861500)	high
86769	AIX 6.1 TL 8 : bind (IV78096)	high
86768	AIX 7.1 TL 3 : bind (IV78095)	high
86767	AIX 7.1 TL 2 : bind (IV78094)	high
86766	AIX 5.3 TL 12 : bind (IV78092)	high
86765	AIX 6.1 TL 9 : bind (IV78091)	high
86656	AIX OpenSSH Advisory : openssh_advisory6.asc	medium
86354	AIX 7.1 TL 3 : netstat (IV77299)	medium
86353	AIX 5.3 TL 12 : netstat (IV77039)	medium
86352	AIX 7.1 TL 2 : netstat (IV77038)	medium
86351	AIX 6.1 TL 8 : netstat (IV77037)	medium
86350	AIX 6.1 TL 9 : netstat (IV75940)	medium
86194	AIX 7.1 TL 2 : bos.rte.lvm (U867549)	high
86126	AIX 6.1 TL 8 : bos.rte.lvm (U868378)	high
85930	AIX OpenSSH Vulnerability : openssh_advisory5.asc	medium
85606	AIX 6.1 TL 8 : ntp (IV74263)	medium
85605	AIX 7.1 TL 2 : ntp (IV74262)	medium
85604	AIX 7.1 TL 3 : ntp (IV74261)	medium
85603	AIX 6.1 TL 9 : ntp (IV73783)	medium
85515	AIX 5.3 TL 12 : sendmail (IV75967) (Logjam)	low
85450	AIX 5.3 TL 12 : bind9 (IV75966)	high
85447	AIX Java Advisory : java_july2015_advisory.asc (Logjam)	critical
85417	AIX 6.1 TL 8 : bind9 (IV75694)	high
85416	AIX 7.1 TL 3 : bind9 (IV75693)	high
85415	AIX 6.1 TL 9 : bind9 (IV75692)	high
85414	AIX 7.1 TL 2 : bind9 (IV75690)	high
85304	AIX 7.1 TL 3 : sendmail (IV75646) (Logjam)	low
85303	AIX 7.1 TL 2 : sendmail (IV75645) (Logjam)	low
85302	AIX 6.1 TL 8 : sendmail (IV75644) (Logjam)	low
85301	AIX 6.1 TL 9 : sendmail (IV75643) (Logjam)	low
84880	AIX OpenSSL Advisory : openssl_advisory14.asc (Logjam)	high
84493	AIX 7.1 TL 0 : ntp4 (IV71096)	medium
84492	AIX 6.1 TL 6 : ntp4 (IV71094)	medium
84275	AIX 6.1 TL 9 : nettcp (IV73976) (POODLE)	medium
84274	AIX 7.1 TL 3 : nettcp (IV73975) (POODLE)	medium
84273	AIX 7.1 TL 2 : nettcp (IV73974) (POODLE)	medium
84272	AIX 6.1 TL 8 : nettcp (IV73973) (POODLE)	medium
84271	AIX 7.1 TL 3 : nettcp (IV73419) (POODLE)	medium
84270	AIX 7.1 TL 2 : nettcp (IV73418) (POODLE)	medium
84269	AIX 6.1 TL 9 : nettcp (IV73417) (POODLE)	medium
84268	AIX 6.1 TL 8 : nettcp (IV73416) (POODLE)	medium
84267	AIX 6.1 TL 9 : nettcp (IV73324) (POODLE)	medium
84266	AIX 7.1 TL 2 : nettcp (IV73319) (POODLE)	medium
84265	AIX 7.1 TL 3 : nettcp (IV73316) (POODLE)	medium
84264	AIX 6.1 TL 8 : nettcp (IV69768) (POODLE)	medium
84087	AIX Java Advisory : java_april2015_advisory.asc (Bar Mitzvah) (FREAK)	critical
83879	AIX 6.1 TL 9 : bos.rte.lvm (U865862)	high

Detections

Analytics

AIX Local Security Checks Family for Nessus

medium

critical

medium

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

low

high

critical

high

high

high

high

low

low

low

low

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

high