IBM AIX could allow a local attacker to escalate their privileges to root access through a vulnerability in netstat when a fiber channel adapter is present.

The remote host is missing AIX PTF U867549, which is related to the security of the package bos.rte.lvm.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The remote host is missing AIX PTF U868378, which is related to the security of the package bos.rte.lvm.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The version of OpenSSH running on the remote host is affected by a security bypass vulnerability due to a failure to check the refusal deadline during the forwarding of untrusted X11 connections. A remote attacker can exploit this to bypass timeout checks and XSECURITY restrictions.

Network Time Protocol (NTP) Project NTP daemon (ntpd) is vulnerable to a denial of service, caused by an error when using symmetric key authentication. By sending specially-crafted packets to both peering hosts, an attacker could exploit this vulnerability to prevent synchronization.

The remote AIX host has a version of Network Time Protocol (NTP) installed that is affected by a denial of service vulnerability due to a flaw in the symmetric-key feature in the receive() function in file ntp_proto.c when receiving certain invalid packets, which causes state-variable updates to be performed. A man-in-the-middle attacker can exploit this, by spoofing the source IP of a peer, to cause a synchronization loss.

The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHE_EXPORT ciphersuite choice. An attacker could exploit this vulnerability using man-in-the-middle techniques to force a downgrade to 512-bit export-grade cipher. Successful exploitation could allow an attacker to recover the session key as well as modify the contents of the traffic. This vulnerability is commonly referred to as 'Logjam'.

ISC BIND is vulnerable to a denial of service, caused by an error in the handling of TKEY queries. By sending specially-crafted packets, a remote attacker could exploit this vulnerability to cause a REQUIRE assertion failure.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities :

  - Java Security Components store plaintext data in memory     dumps, which allows a local attacker to gain access to     sensitive information. (CVE-2015-1931)

  - A flaw exists in the readSerialData() function in     class ObjectInputStream.java when handling OIS data,     which allows an attacker to execute arbitrary code.
    (CVE-2015-2590)

  - Multiple flaws exist in the JCE component due to     various cryptographic operations using non-constant     time comparisons. A remote attacker can exploit this     to conduct timing attacks to gain access to sensitive     information. (CVE-2015-2601)

  - A flaw exists in the ECDH_Derive() function in file     ec.c due to missing EC parameter validation when     performing ECDH key derivation. A remote attacker can     exploit this to access sensitive information.
    (CVE-2015-2613)

  - An unspecified vulnerability exists in the 2D component     that allows a remote attacker to access sensitive     information. (CVE-2015-2619, CVE-2015-2637)

  - A flaw exists in the RMIConnectionImpl constructor     in class RMIConnectionImpl.java due to improper     permission checks when creating repository class     loaders. An attacker can exploit this to bypass sandbox     restrictions and access sensitive information.
    (CVE-2015-2621)

  - An unspecified flaw exists in the JSSE component when     handling the SSL/TLS protocol. A remote attacker can     exploit this to gain access to sensitive information.
    (CVE-2015-2625)

  - An integer overflow condition exists in the     International Components for Unicode for C/C++ (ICU4C).
    An attacker, using a specially crafted font, can exploit     this to crash an application using this library or     access memory contents. (CVE-2015-2632)

  - A unspecified vulnerability exists in the 2D component     that allows a remote attacker to execute arbitrary     code. (CVE-2015-2638)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to gain elevated     privileges. (CVE-2015-2664)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

  - An unspecified vulnerability exists in the Deployment     component that impacts confidentiality and integrity.
    (CVE-2015-4729)

  - A flaw exists in class MBeanServerInvocationHandler.java     when handling MBean connection proxy classes. An     attacker can exploit this to bypass sandbox restrictions     and execute arbitrary code. (CVE-2015-4731)

  - Multiple flaws exist in classes ObjectInputStream.java     and SerialCallbackContext.java related to insufficient     context checking. An attacker can exploit these to     execute arbitrary code. (CVE-2015-4732)

  - A flaw exists in the invoke() method in the class     RemoteObjectInvocationHandler.java due to calls to the     finalize() method being permitted. An attacker can     exploit this to bypass sandbox protections and execute     arbitrary code. (CVE-2015-4733)

  - An unspecified flaw exists in the Deployment component     that allows a local attacker to execute arbitrary code.
    (CVE-2015-4736)

  - A flaw exists in the Security component when handling     Online Certificate Status Protocol (OCSP) responses with     no 'nextUpdate'. A remote attacker can exploit this to     cause an application to accept a revoked X.509     certificate. (CVE-2015-4748)

  - An flaw exists in the query() method in class     DnsClient.java due to a failure by the JNDI component's     exception handling to release request information. A     remote attacker can exploit this to cause a denial of     service. (CVE-2015-4749)

  - An integer overflow condition exists in the layout     engine in the International Components for Unicode for     C/C++ (ICU4C). An attacker, using a specially crafted     font, can exploit this to crash an application using     this library or execute arbitrary code. (CVE-2015-4760)

The version of OpenSSL installed on the remote AIX host is affected by multiple vulnerabilities :

  - An invalid free memory error exists due to improper     validation of user-supplied input when a DTLS peer     receives application data between ChangeCipherSpec and     Finished messages. A remote attacker can exploit this to     corrupt memory, resulting in a denial of service or     the execution of arbitrary code. (CVE-2014-8176)

  - A denial of service vulnerability exists when processing     an ECParameters structure due to an infinite loop that     occurs when a specified curve is over a malformed binary     polynomial field. A remote attacker can exploit this to     perform a denial of service against any system that     processes public keys, certificate requests, or     certificates. This includes TLS clients and TLS servers     with client authentication enabled. (CVE-2015-1788)

  - A denial of service vulnerability exists due to improper     validation of the content and length of the ASN1_TIME     string by the X509_cmp_time() function. A remote     attacker can exploit this, via a malformed certificate     and CRLs of various sizes, to cause a segmentation     fault, resulting in a denial of service condition. TLS     clients that verify CRLs are affected. TLS clients and     servers with client authentication enabled may be     affected if they use custom verification callbacks.
    (CVE-2015-1789)

  - A NULL pointer dereference flaw exists in the PKCS#7     parsing code due to incorrect handling of missing inner     'EncryptedContent'. This allows a remote attacker, via     specially crafted ASN.1-encoded PKCS#7 blobs with     missing content, to cause a denial of service condition     or other potential unspecified impacts. (CVE-2015-1790)

  - A double-free error exists due to a race condition that     occurs when a NewSessionTicket is received by a     multi-threaded client when attempting to reuse a     previous ticket. (CVE-2015-1791)

  - A denial of service vulnerability exists in the CMS code     due to an infinite loop that occurs when verifying a     signedData message. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-1792)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9297 Network Time Protocol (NTP) Project NTP daemon (ntpd) could allow a remote attacker to conduct spoofing attacks, caused by insufficient entropy in PRNG. An attacker could exploit this vulnerability to spoof the IPv6 address ::1 to bypass ACLs and launch further attacks on the system. Network Time Protocol (NTP) Project NTP daemon (ntpd) is vulnerable to a denial of service, caused by an error when using symmetric key authentication. By sending specially-crafted packets to both peering hosts, an attacker could exploit this vulnerability to prevent synchronization.

A man-in-the-middle (MitM) information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. A MitM attacker can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities :

  - The Global Security Kit (GSKit) contains a flaw due to     improper restrictions of TLS state transitions. A     man-in-the-middle attacker can exploit this to downgrade     the security of a session to use EXPORT_RSA ciphers.
    This allows the attacker to more easily break the     encryption and monitor or tamper with the encrypted     stream. (CVE-2015-0138)

  - An unspecified flaw exists that allows an attacker to     execute code running under a security manager with     elevated privileges.(CVE-2015-0192)

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to the     support of weak EXPORT_RSA cipher suites with keys less     than or equal to 512 bits. A man-in-the-middle attacker     may be able to downgrade the SSL/TLS connection to use     EXPORT_RSA cipher suites which can be factored in a     short amount of time, allowing the attacker to intercept     and decrypt the traffic. (CVE-2015-0204)

  - Multiple unspecified vulnerabilities exist in multiple     Java subcomponents including 2D, Beans, Deployment, JCE,     JSSE, and tools. (CVE-2015-0458, CVE-2015-0459,     CVE-2015-0469, CVE-2015-0477, CVE-2015-0478,     CVE-2015-0480, CVE-2015-0486, CVE-2015-0488,     CVE-2015-0491)

  - An unspecified flaw exists that allows a remote attacker     to bypass permission checks and gain access to sensitive     information. (CVE-2015-1914)

  - An unspecified flaw exists due to the Socket Extension     Provider's handling of TLS and SSL connections. A remote     attacker can exploit this to cause a denial of service.
    (CVE-2015-1916)

  - A security feature bypass vulnerability exists, known as     Bar Mitzvah, due to improper combination of state data     with key data by the RC4 cipher algorithm during the     initialization phase. A man-in-the-middle attacker can     exploit this, via a brute-force attack using LSB values,     to decrypt the traffic. (CVE-2015-2808)

The remote host is missing AIX PTF U865862, which is related to the security of the package bos.rte.lvm.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The remote host is missing AIX PTF U865854, which is related to the security of the package bos.rte.lvm.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The version of the Network Authentication Service (NAS) installed on the remote AIX host is affected by the following vulnerabilities related to Kerberos 5 :

  - Denial of service and remote code execution     vulnerabilities exist due to security context handles     not being properly maintained, allowing an     authenticated, remote attacker to crash the service or     execute arbitrary code using crafted GSSAPI traffic.
    (CVE-2014-5352)

  - A denial of service vulnerability exists due to improper     handling of zero-byte or unterminated strings.
    (CVE-2014-5355)

  - Denial of service and remote code execution     vulnerabilities exist which allow an authenticated,     remote attacker to crash the service or execute     arbitrary code using crafted, malformed XDR data.
    (CVE-2014-9421)

  - A privilege escalation vulnerability exists that allows     an authenticated, remote attacker to gain administrative     access via a flaw in kadmin authorization checks.
    (CVE-2014-9422)

  - An information disclosure vulnerability allows an     attacker to gain information about process heap memory     from NAS packets. (CVE-2014-9423)

The version of Java SDK installed on the remote host is affected by multiple vulnerabilities :

  - A man-in-the-middle information disclosure vulnerability     exists due to a TLS security downgrade flaw. A     man-in-the-middle attacker may be able to downgrade the     SSL/TLS connection to use EXPORT_RSA cipher suites which     can be factored in a short amount of time, allowing the     attacker to intercept and decrypt the traffic.
    (CVE-2015-0138)

  - A flaw exists in the RC4 algorithm implementation due to     improper combination of state data with key data during     the initialization phase. A man-in-the-middle attacker     can exploit this to conduct plaintext-recovery attacks.
    (CVE-2015-2808)

The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities :

  - A use-after-free condition exists in the     d2i_ECPrivateKey() function due to improper processing     of malformed EC private key files during import. A     remote attacker can exploit this to dereference or free     already freed memory, resulting in a denial of service     or other unspecified impact. (CVE-2015-0209)

  - An invalid read flaw exists in the ASN1_TYPE_cmp()     function due to improperly performed boolean-type     comparisons. A remote attacker can exploit this, via a     crafted X.509 certificate to an endpoint that uses the     certificate-verification feature, to cause an invalid     read operation, resulting in a denial of service.
    (CVE-2015-0286)

  - A flaw exists in the ASN1_item_ex_d2i() function due to     a failure to reinitialize 'CHOICE' and 'ADB' data     structures when reusing a structure in ASN.1 parsing.
    This allows a remote attacker to cause an invalid write     operation and memory corruption, resulting in a denial     of service. (CVE-2015-0287)

  - A NULL pointer dereference flaw exists in the     X509_to_X509_REQ() function due to improper processing     of certificate keys. This allows a remote attacker, via     a crafted X.509 certificate, to cause a denial of     service. (CVE-2015-0288)

  - A NULL pointer dereference flaw exists in the PKCS#7     parsing code due to incorrect handling of missing outer     ContentInfo. This allows a remote attacker, using an     application that processes arbitrary PKCS#7 data and     providing malformed data with ASN.1 encoding, to cause     a denial of service. (CVE-2015-0289)

  - An integer underflow condition exists in the     EVP_DecodeUpdate() function due to improper validation     of base64 encoded input when decoding. This allows a     remote attacker, using maliciously crafted base64 data,     to cause a segmentation fault or memory corruption,     resulting in a denial of service or possibly the     execution of arbitrary code. (CVE-2015-0292)

  - A flaw exists in servers that both support SSLv2 and     enable export cipher suites due to improper     implementation of SSLv2. A remote attacker can exploit     this, via a crafted CLIENT-MASTER-KEY message, to cause     a denial of service. (CVE-2015-0293)

CVE-2014-8769 tcpdump is vulnerable to a denial of service, caused by the improper handling of input by the application decoder for the Ad hoc On-Demand Distance Vector (AODV) protocol. By sending specially-crafted data, a remote attacker could exploit this vulnerability to cause the application to crash.

Please see following for more information :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8769

CVE-2014-8500 ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals. 

Please see following for more information :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500

ID	Name	Severity
86354	AIX 7.1 TL 3 : netstat (IV77299)	medium
86353	AIX 5.3 TL 12 : netstat (IV77039)	medium
86352	AIX 7.1 TL 2 : netstat (IV77038)	medium
86351	AIX 6.1 TL 8 : netstat (IV77037)	medium
86350	AIX 6.1 TL 9 : netstat (IV75940)	medium
86194	AIX 7.1 TL 2 : bos.rte.lvm (U867549)	high
86126	AIX 6.1 TL 8 : bos.rte.lvm (U868378)	high
85930	AIX OpenSSH Vulnerability : openssh_advisory5.asc	medium
85606	AIX 6.1 TL 8 : ntp (IV74263)	medium
85605	AIX 7.1 TL 2 : ntp (IV74262)	medium
85604	AIX 7.1 TL 3 : ntp (IV74261)	medium
85603	AIX 6.1 TL 9 : ntp (IV73783)	medium
85515	AIX 5.3 TL 12 : sendmail (IV75967) (Logjam)	low
85450	AIX 5.3 TL 12 : bind9 (IV75966)	high
85447	AIX Java Advisory : java_july2015_advisory.asc (Logjam)	critical
85417	AIX 6.1 TL 8 : bind9 (IV75694)	high
85416	AIX 7.1 TL 3 : bind9 (IV75693)	high
85415	AIX 6.1 TL 9 : bind9 (IV75692)	high
85414	AIX 7.1 TL 2 : bind9 (IV75690)	high
85304	AIX 7.1 TL 3 : sendmail (IV75646) (Logjam)	low
85303	AIX 7.1 TL 2 : sendmail (IV75645) (Logjam)	low
85302	AIX 6.1 TL 8 : sendmail (IV75644) (Logjam)	low
85301	AIX 6.1 TL 9 : sendmail (IV75643) (Logjam)	low
84880	AIX OpenSSL Advisory : openssl_advisory14.asc (Logjam)	high
84493	AIX 7.1 TL 0 : ntp4 (IV71096)	medium
84492	AIX 6.1 TL 6 : ntp4 (IV71094)	medium
84275	AIX 6.1 TL 9 : nettcp (IV73976) (POODLE)	medium
84274	AIX 7.1 TL 3 : nettcp (IV73975) (POODLE)	medium
84273	AIX 7.1 TL 2 : nettcp (IV73974) (POODLE)	medium
84272	AIX 6.1 TL 8 : nettcp (IV73973) (POODLE)	medium
84271	AIX 7.1 TL 3 : nettcp (IV73419) (POODLE)	medium
84270	AIX 7.1 TL 2 : nettcp (IV73418) (POODLE)	medium
84269	AIX 6.1 TL 9 : nettcp (IV73417) (POODLE)	medium
84268	AIX 6.1 TL 8 : nettcp (IV73416) (POODLE)	medium
84267	AIX 6.1 TL 9 : nettcp (IV73324) (POODLE)	medium
84266	AIX 7.1 TL 2 : nettcp (IV73319) (POODLE)	medium
84265	AIX 7.1 TL 3 : nettcp (IV73316) (POODLE)	medium
84264	AIX 6.1 TL 8 : nettcp (IV69768) (POODLE)	medium
84087	AIX Java Advisory : java_april2015_advisory.asc (Bar Mitzvah) (FREAK)	critical
83879	AIX 6.1 TL 9 : bos.rte.lvm (U865862)	high
83878	AIX 7.1 TL 3 : bos.rte.lvm (U865854)	high
83874	AIX NAS Advisory : nas_advisory3.asc	high
83135	AIX Java Advisory : Multiple Vulnerabilities (Bar Mitzvah)	medium
82900	AIX OpenSSL Advisory : openssl_advisory13.asc	high
81923	AIX 6.1 TL 9 : tcpdump (IV68992)	medium
81922	AIX 7.1 TL 2 : tcpdump (IV68951)	medium
81921	AIX 6.1 TL 8 : tcpdump (IV68950)	medium
81920	AIX 7.1 TL 3 : tcpdump (IV67588)	medium
81502	AIX 5.3 TL 12 : bind9 (IV68997)	high
81501	AIX 7.1 TL 3 : bind9 (IV68996)	high

Detections

Analytics

AIX Local Security Checks Family for Nessus

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

low

high

critical

high

high

high

high

low

low

low

low

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

high

high

high

medium

high

medium

medium

medium

medium

high

high