The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The version of rsyslog installed on the remote AIX host is affected by a remote code execution or denial of service vulnerability :

  - The installed rsyslog allows remote attackers to cause a     denial of service (crash), possibly execute arbitrary     code, or have other unspecified impacts by crafting a     priority (PRI) value that triggers an out-of-bounds     array access. (CVE-2014-3634)

  - The original fix for the above issue still retained a     denial of service vulnerability when large PRI values     were encountered. (CVE-2014-3683)

The version of Java SDK installed on the remote host is affected by the following vulnerabilities :

  - A privilege escalation vulnerability in the IBM Java SDK     allows a local attacker to inject arbitrary code into     the shared classes cache due to a flaw in the default     configuration for the shared classes feature. Other     users are able to execute the injected code, which can     allow the attacker to gain elevated privileges.
    (CVE-2014-3065)

  - Oracle Java contains the flaw related to SSLv3 CBC-mode     ciphers known as POODLE. The vulnerability is due to the     way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. A man-in-the-middle attacker can     decrypt a selected byte of a cipher text in as few as     256 tries if they are able to force a victim application     to repeatedly send the same data over newly created SSL     3.0 connections. (CVE-2014-3566)

  - Vulnerabilities in Oracle Java allow remote code     execution via flaws in the Deployment subcomponent.
    (CVE-2014-4288, CVE-2014-6492, CVE-2014-6493,     CVE-2014-6503, CVE-2014-6532)

  - A session hijacking vulnerability exists in Oracle Java     due to a flaw related to handling of server certificate     changes during SSL/TLS renegotiation. This allows an     attacker to intercept communication between a client and     server to hijack a mutually authenticated session.
    (CVE-2014-6457)

  - Privilege escalation vulnerabilities exist in Oracle     Java within the the Deployment subcomponent.
    (CVE-2014-6458, CVE-2014-6466)

  - Data integrity vulnerabilities exist in Oracle Java     within the the Deployment subcomponent. (CVE-2014-6476,     CVE-2014-6515, CVE-2014-6527)

  - A privilege escalation vulnerability exists in Oracle     Java in the resource bundle handling code of the     'LogRecord::readObject' function within the file     'share/classes/java/util/logging/LogRecord.java',     which allows an attacker to bypass certain sandbox     restrictions. (CVE-2014-6502)

  - A privilege escalation vulnerability exists in Oracle     Java within the property processing and name handling     code of 'share/classes/java/util/ResourceBundle.java',     which allows an attacker to bypass certain sandbox     restrictions. (CVE-2014-6506)

  - Oracle Java contains an unspecified vulnerability in the     2D subcomponent. (CVE-2014-6511)

  - An information disclosure vulnerability exists in Oracle     Java due to a flaw related to the wrapping of datagram     sockets in the DatagramSocket implementation. This issue     may cause packets to be read that originate from other     sources than the connected, thus allowing a remote     attacker to carry out IP spoofing. (CVE-2014-6512)

  - A flaw exists in the way splash images are handled by     'windows/native/sun/awt/splashscreen/splashscreen_sys.c'     which allows remote code execution. (CVE-2014-6513)

  - A privilege escalation vulnerability exists in Oracle     Java in 'share/classes/java/util/logging/Logger.java'     because it fails to check permissions in certain cases,     allowing an attacker to bypass sandbox restrictions and     view or edit logs. (CVE-2014-6531)

  - A flaw related to input cipher streams within the file     'share/classes/javax/crypto/CipherInputStream.java' can     allow a remote attacker to affect the data integrity.
    (CVE-2014-6558)

The remote host is missing AIX PTF U862099, which is related to the security of the package bos.rte.control.

Libxml2 is vulnerable to a denial of service, caused by the expansion of internal entities within the xmlParserHandlePEReference().

The remote host is missing AIX PTF U861276, which is related to the security of the package bos.rte.control.

Libxml2 is vulnerable to a denial of service, caused by the expansion of internal entities within the xmlParserHandlePEReference().

The version of OpenSSL installed on the remote host is affected by the following vulnerabilities :

  - An error exists related to DTLS SRTP extension handling     and specially crafted handshake messages that can allow     denial of service attacks via memory leaks.
    (CVE-2014-3513)

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. MitM attackers can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566)

  - An error exists related to session ticket handling that     can allow denial of service attacks via memory leaks.
    (CVE-2014-3567)

The version of OpenSSL installed on the remote host is affected by the following vulnerabilities :

  - A memory double-free error exists related to handling     DTLS packets that allows denial of service attacks.
    (CVE-2014-3505)

  - An unspecified error exists related to handling DTLS     handshake messages that allows denial of service attacks     due to large amounts of memory being consumed.
    (CVE-2014-3506)

  - A memory leak error exists related to handling     specially crafted DTLS packets that allows denial of     service attacks. (CVE-2014-3507)

  - An error exists related to 'OBJ_obj2txt' and the pretty     printing 'X509_name_*' functions which leak stack data,     resulting in an information disclosure. (CVE-2014-3508)

  - An error exists related to 'ec point format extension'     handling and multithreaded clients that allows freed     memory to be overwritten during a resumed session.
    (CVE-2014-3509)

  - A NULL pointer dereference error exists related to     handling anonymous ECDH cipher suites and crafted     handshake messages that allow denial of service attacks     against clients. (CVE-2014-3510)

  - An error exists related to handling fragmented     'ClientHello' messages that could allow a     man-in-the-middle attacker to force usage of TLS 1.0     regardless of higher protocol levels being supported by     both the server and the client. (CVE-2014-3511)

  - A buffer overflow error exists related to handling     Secure Remote Password protocol (SRP) parameters having     unspecified impact. (CVE-2014-3512)

  - A NULL pointer dereference error exists related to     handling Secure Remote Password protocol (SRP) that     allows a malicious server to crash a client, resulting     in a denial of service. (CVE-2014-5139)

The version of the Network Authentication Service (NAS) installed on the remote AIX host is affected by the following vulnerabilities related to Kerberos 5 :

  - An attacker can cause a denial of service (buffer     over-read and application crash) by injecting invalid     tokens into a GSSAPI application session.
    (CVE-2014-4341)

  - An attacker with the ability to spoof packets appearing     to be from a GSSAPI acceptor can cause a denial of     service or execute arbitrary code by using a double-free     condition in GSSAPI initiators (clients) which are using     the SPNEGO mechanism, by returning a different     underlying mechanism than was proposed by the initiator.
    (CVE-2014-4343)

  - An attacker can cause a denial of service through a NULL     pointer dereference and application crash during a     SPNEGO negotiation, by sending an empty token as the     second or later context token from initiator to     acceptor. (CVE-2014-4344)

The remote host is missing AIX PTF U865807, which is related to the security of the package bos.rte.odm.

AIX could allow a arbitrary file overwrite symlink vulnerability due to libodm.a bug.

The remote host is missing AIX PTF U865667, which is related to the security of the package bos.rte.odm.

AIX could allow a arbitrary file overwrite symlink vulnerability due to libodm.a bug.

The remote host is missing AIX PTF U865621, which is related to the security of the package X11.base.rte.

Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.

The remote host is missing AIX PTF U865364, which is related to the security of the package X11.base.rte.

Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.

The remote host is missing AIX PTF U862133, which is related to the security of the package bos.mp64.

IBM AIX is vulnerable to a denial of service, caused by an error in the ptrace() function. A local attacker could exploit this vulnerability to cause a system crash.

The remote host is missing AIX PTF U861576, which is related to the security of the package bos.mp64.

IBM AIX is vulnerable to a denial of service, caused by an error in the ptrace() function. A local attacker could exploit this vulnerability to cause a system crash.

The remote host is missing AIX PTF U865302, which is related to the security of the package bos.rte.odm.

AIX could allow a arbitrary file overwrite symlink vulnerability due to libodm.a bug.

The remote host is missing AIX PTF U862346, which is related to the security of the package X11.base.rte.

Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.

The remote host is missing AIX PTF U861815, which is related to the security of the package bos.mp64.

IBM AIX is vulnerable to a denial of service, caused by an error in the ptrace() function. A local attacker could exploit this vulnerability to cause a system crash.

The remote host is missing AIX PTF U860787, which is related to the security of the package bos.rte.odm.

AIX could allow a arbitrary file overwrite symlink vulnerability due to libodm.a bug.

The remote host is missing AIX PTF U860766, which is related to the security of the package X11.base.rte.

Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.

The remote host is missing AIX PTF U859634, which is related to the security of the package bos.mp64.

IBM AIX is vulnerable to a denial of service, caused by an error in the ptrace() function. A local attacker could exploit this vulnerability to cause a system crash.

The version of Java SDK installed on the remote host is affected by the following vulnerabilities :

  - A privilege escalation vulnerability in IBM Java     Virtual Machine allows remote attackers to execute code     to increase access in the context of a security manager.
    (CVE-2014-3086)

  - Data integrity vulnerabilities exist in Oracle Java     within the the Deployment subcomponent. (CVE-2014-4208,     CVE-2014-4220, CVE-2014-4265)

  - An information disclosure vulnerability in Oracle Java's     JMX subcomponent allows a remote attacker to view or     edit the SubjectDelegator class. (CVE-2014-4209)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features via flaws in 'Proxy.java'     in the Libraries subcomponent. (CVE-2014-4218)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in the Hotspot subcomponent,     returning incomplete objects. (CVE-2014-4219)

  - An information disclosure vulnerability in Oracle Java's     Libraries subcomponent allows a remote attacker to view     sensitive information. (CVE-2014-4221)

  - Vulnerabilities in Oracle Java allow remote code     execution via flaws in the Deployment subcomponent.
    (CVE-2014-4227)

  - There are information disclosure vulnerabilities in the     Security subcomponent of Oracle Java that can allow     remote attackers to gain sensitive information,     including information about used keys. (CVE-2014-4244,     CVE-2014-4252, CVE-2014-4263)

  - A vulnerability in Oracle Java allows remote code     execution via a memory corruption flaw in the Libraries     subcomponent. (CVE-2014-4262)

  - A data integrity vulnerability exists in Oracle Java     within the Serviceability subcomponent due to incorrect     function return values. (CVE-2014-4266)

  - An information disclosure vulnerability in Oracle Java's     Swing subcomponent allows a remote attacker to view     restricted file contents. (CVE-2014-4268)

It has been identified that the runtime linker allows privilege escalation via arbitrary file writes with elevated privileges programs. When MALLOCOPTIONS and MALLOCBUCKETS environment variables are set with bucket statistics options and by executing certain setuid programs, a non-privileged user may able to create a root owned file with 666 permission. 

In AIX6.1 and above, a local user can also exploit this error using the _LIB_INIT_DBG and _LIB_INIT_DBG_FILE environment variables.

It has been identified that the runtime linker allows privilege escalation via arbitrary file writes with elevated privileges programs. When MALLOCOPTIONS and MALLOCBUCKETS environment variables are set with bucket statistics options and by executing certain setuid programs, a non-privileged user may able to create a root owned file with 666 permission.

In AIX6.1 and above, a local user can also exploit this error using the _LIB_INIT_DBG and _LIB_INIT_DBG_FILE environment variables.

Libxml2 is vulnerable to a denial of service, caused by the expansion of internal entities within the xmlParserHandlePEReference().

The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification via DNS queries with spoofed source IP addresses. Please see following for more information :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0987

The version of Java SDK installed on the remote host is potentially affected by the following vulnerabilities :

  - Vulnerabilities in Oracle Java allow a remote attacker     to bypass security features through flaws in XML     document parsing. (CVE-2013-5878, CVE-2013-5910)

  - An information disclosure flaw in Oracle Java allows a     remote attacker access to sensitive information through     a flaw in the COBRA component. (CVE-2013-5884)

  - A vulnerability in Oracle Java allows a remote attacker     to conduct a denial of service attack through a flaw in     the Deployment component. (CVE-2013-5887)

  - Unspecified vulnerabilities exist in Oracle Java due     to flaws in the Deployment component. (CVE-2013-5888,     CVE-2013-5898, CVE-2013-5899, CVE-2014-0375,     CVE-2014-0403, CVE-2014-0424)

  - Vulnerabilities in Oracle Java allow remote code     execution through a flaw in the Deployment component.
    (CVE-2013-5889, CVE-2014-0387, CVE-2014-0410,     CVE-2014-0415)

  - A vulnerability in Oracle Java allows a remote attacker     to conduct a denial of service attack through a flaw in     the COBRA component. (CVE-2013-5896)

  - A vulnerability in Oracle Java allows remote code     execution through a flaw in the 2D component.
    (CVE-2013-5907)

  - An information disclosure and security bypass flaw exist     in Oracle Java's Networking component. (CVE-2014-0368)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in the     Serviceability component. (CVE-2014-0373)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in the JAXP     component. (CVE-2014-0376)

  - An information disclosure flaw in Oracle Java allows a     remote attacker access to information about encryption     keys through a flaw in the JSSE component.
    (CVE-2014-0411)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in the JAAS     component. (CVE-2014-0416)

  - An unspecified vulnerability exists in Oracle Java due     to flaws in the 2D component. (CVE-2014-0417)

  - A vulnerability in Oracle Java allows remote code     execution through a flaw in the JNDI component.
    (CVE-2014-0422)

  - An information disclosure and denial of service flaw     exist in Oracle Java's Beans component when XML data is     read. (CVE-2014-0423)

  - A vulnerability in Oracle Java allows remote code     execution through a flaw in the COBRA component.
    (CVE-2014-0428)

The version of Java SDK installed on the remote host is potentially affected by the following vulnerabilities :

  - There is an information disclosure flaw in libjpeg and     libjpeg-turbo allowing remote attackers access to     uninitialized memory via crafted JPEG images.
    (CVE-2013-6629)

  - A vulnerability in libpng allows denial of service     attacks via a flaw in pngtran.c pngset.c.
    (CVE-2013-6954)

  - Vulnerabilities in Oracle Java allow remote code     execution via flaws in 2D image handling.
    (CVE-2014-0429, CVE-2014-2401, CVE-2014-2421)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in logger handling.
    (CVE-2014-0446)

  - Vulnerabilities in Oracle Java allow remote code     execution via flaws in the Deployment subcomponent.
    (CVE-2014-0448, CVE-2014-0449, CVE-2014-2409,     CVE-2014-2420, CVE-2014-2428)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in AWT.
    (CVE-2014-0451, CVE-2014-2412)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in     W3CEndpointReference.java. (CVE-2014-0452)

  - An information disclosure vulnerability in Oracle Java     RSAPadding allows a remote attacker to view timing     information protected by encryption. (CVE-2014-0452)

  - A vulnerability in Oracle Java allows a remote attacker     to modify the SIGNATURE_PRIMITIVE_SET through flaws in     SignatureAndHalshAlgorithm and AlgorithmChecker.
    (CVE-2014-0454)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in MethodHandles.java.
    (CVE-2014-0455)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in exception handling.
    (CVE-2014-0457)

  - Vulnerabilities in Oracle Java allow a remote attacker     to bypass security features through flaws in JAX-WS.
    (CVE-2014-0458, CVE-2014-2423)

  - An unspecified vulnerability exists in Oracle Java     via sandboxed applications.
    (CVE-2014-0459)

  - A vulnerability in Oracle Java allows remote attackers     to conduct spoofing attacks via a flaw in the DnsClient     component. (CVE-2014-0460)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in ScriptEngineManager.java.
    (CVE-2014-0461)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in the random     number generation of cryptographic protection.
    (CVE-2014-0878)

  - A privilege escalation vulnerability in Oracle Java     allows remote attacks to overwrite arbitrary files     via a flaw in unpack200. (CVE-2014-1876)

  - A vulnerability in Oracle Java allows remote code     execution via a flaw in Javadoc. (CVE-2014-2398)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in     asynchronous channel handling across threads.
    (CVE-2014-2402)

  - Vulnerabilities in Oracle Java allow a remote attacker     to bypass security features through flaws in JAXB.
    (CVE-2014-2414)

  - A vulnerability in Oracle Java allows a remote attacker     to bypass security features through flaws in Java sound     libraries. (CVE-2014-2427)

The version of OpenSSH running on the remote host is affected by multiple security bypass vulnerabilities :

  - sshd in OpenSSH versions before 6.6 do not properly     support wildcards on AcceptEnv lines in sshd_config,     which allow a remote attacker to bypass intended     environment restrictions by using a substring located     before a wildcard character. (CVE-2014-2532)

  - The verify_host_key function in sshconnect.c in the     OpenSSH client for versions 6.6 and earlier allows     remote servers to trigger the skipping of SSHFP DNS     checking by presenting an unacceptable HostCertificate.
    (CVE-2014-2653)

The monlist feature in ntpd in NTP allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests.

ID	Name	Severity
80502	AIX 7.1 TL 2 : lvm (IV68478)	high
80500	AIX 6.1 TL 8 : lvm (IV68082)	high
80499	AIX 5.3 TL 12 : lvm (IV68070)	high
80498	AIX 7.1 TL 3 : lvm (IV67908)	high
79660	AIX rsyslog Advisory : rsyslog_advisory.asc	high
79626	AIX Java Advisory : java_oct2014_advisory.asc (POODLE)	critical
79063	AIX 7.1 TL 3 : bos.rte.control (U862099)	medium
79062	AIX 6.1 TL 9 : bos.rte.control (U861276)	medium
78772	AIX OpenSSL Advisory : openssl_advisory11.asc (POODLE)	high
77603	AIX OpenSSL Advisory : openssl_advisory10.asc	high
77532	AIX NAS Advisory : nas_advisory1.asc	high
77417	AIX 6.1 TL 7 : bos.rte.odm (U865807)	medium
77416	AIX 6.1 TL 8 : bos.rte.odm (U865667)	medium
77415	AIX 6.1 TL 7 : X11.base.rte (U865621)	high
77414	AIX 6.1 TL 8 : X11.base.rte (U865364)	high
77413	AIX 6.1 TL 8 : bos.mp64 (U862133)	medium
77412	AIX 6.1 TL 7 : bos.mp64 (U861576)	medium
77383	AIX 7.1 TL 2 : bos.rte.odm (U865302)	medium
77382	AIX 7.1 TL 2 : X11.base.rte (U862346)	high
77381	AIX 7.1 TL 1 : bos.mp64 (U861815)	medium
77380	AIX 7.1 TL 1 : bos.rte.odm (U860787)	medium
77379	AIX 7.1 TL 1 : X11.base.rte (U860766)	high
77378	AIX 7.1 TL 2 : bos.mp64 (U859634)	medium
77333	AIX Java Advisory : java_jul2014_advisory.asc	critical
77267	AIX 5.3 TL 12 : malloc (IV62812)	high
77266	AIX 7.1 TL 3 : malloc (IV62808)	high
77265	AIX 7.1 TL 2 : malloc (IV62807)	high
77264	AIX 7.1 TL 1 : malloc (IV62806)	high
77263	AIX 6.1 TL 9 : malloc (IV62805)	high
77262	AIX 6.1 TL 8 : malloc (IV62803)	high
77261	AIX 6.1 TL 7 : malloc (IV62802)	high
77260	AIX 7.1 TL 3 : libxml2 (IV62450)	medium
77259	AIX 7.1 TL 2 : libxml2 (IV62449)	medium
77258	AIX 6.1 TL 9 : libxml2 (IV62448)	medium
77257	AIX 6.1 TL 8 : libxml2 (IV62447)	medium
77256	AIX 5.3 TL 12 : bind9 (IV62327)	medium
77255	AIX 6.1 TL 9 : bind9 (IV62225)	medium
77254	AIX 6.1 TL 7 : bind9 (IV62224)	medium
77253	AIX 6.1 TL 8 : bind9 (IV62146)	medium
77252	AIX 7.1 TL 1 : bind9 (IV61093)	medium
77251	AIX 7.1 TL 2 : bind9 (IV61090)	medium
77250	AIX 7.1 TL 3 : bind9 (IV61027)	medium
76871	AIX Java Advisory : java_jan2014_advisory.asc	critical
76870	AIX Java Advisory : java_apr2014_advisory.asc	critical
76168	AIX OpenSSH Vulnerability : openssh_advisory4.asc	medium
76080	AIX 5.3 TL 12 : ntp (IV59636)	medium
76079	AIX 6.1 TL 7 : ntp (IV58413)	medium
76078	AIX 6.1 TL 8 : ntp (IV58068)	medium
76077	AIX 7.1 TL 1 : ntp (IV56575)	medium
76076	AIX 7.1 TL 3 : ntp (IV56324)	medium

Detections

Analytics

AIX Local Security Checks Family for Nessus

high

high

high

high

high

critical

medium

medium

high

high

high

medium

medium

high

high

medium

medium

medium

high

medium

medium

high

medium

critical

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium