AIX could allow a arbitrary file overwrite symlink vulnerability due to libodm.a bug.

IBM AIX is vulnerable to a denial of service, caused by an error in the ptrace() function. A local attacker could exploit this vulnerability to cause a system crash.

The version of Perl on the remote host is affected by a code execution vulnerability. 

The _compile function in Locale::Maketext in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation. This could allow context- dependent attackers to execute arbitrary commands via crafted input.

The version of OpenSSL running on the remote host is affected by the following vulnerabilities :

  - A vulnerability in the way SSL and TLS protocols allow     renegotiation requests may allow an attacker to inject     plaintext into an application protocol stream. This     could result in a situation where the attacker may be     able to issue commands to the server that appear to be     coming from a legitimate source.

  - A remote, unauthenticated attacker may be able to inject     an arbitrary amount of chosen plaintext into the     beginning of the application protocol stream. This could     allow an attacker to issue HTTP requests or take action     impersonating the user, among other consequences.

Please note that the recommended fixes will disable all session renegotiation.

The version of OpenSSH running on the remote host is affected by the following vulnerabilities :

  - OpenSSH 4.3p2, and probably other versions, allows local     users to hijack forwarded X connections by causing ssh     to set DISPLAY to :10, even when another process is     listening on the associated port, as demonstrated by     opening TCP port 6010 (IPv4) and sniffing a cookie sent     by Emacs. (CVE-2008-1483)

  - OpenSSH before 4.9 allows remote authenticated users to     bypass the sshd_config ForceCommand directive by     modifying the .ssh/rc session file. (CVE-2008-1657)

The version of OpenSSL running on the remote host is affected by the following vulnerabilities :

  - A carefully crafted invalid TLS handshake could crash     OpenSSL with a NULL pointer exception. A malicious     server could use this flaw to crash a connecting client.
    This issue only affected OpenSSL 1.0.1 versions.
    (CVE-2013-4353)

  - A flaw in DTLS handling can cause an application using     OpenSSL and DTLS to crash. This is not a vulnerability     for OpenSSL prior to 1.0.0. OpenSSL is vulnerable to a     denial of service, caused by the failure to properly     maintain data structures for digest and encryption     contexts by the DTLS retransmission implementation. A     remote attacker could exploit this vulnerability to     cause the daemon to crash. (CVE-2013-6450)

  - A flaw in OpenSSL can cause an application using     OpenSSL to crash when using TLS version 1.2. This issue     only affected OpenSSL 1.0.1 versions. OpenSSL is     vulnerable to a denial of service, caused by an error in     the ssl_get_algorithm2 function. A remote attacker could     exploit this vulnerability using specially crafted     traffic from a TLS 1.2 client to cause the daemon to     crash. (CVE-2013-6449)

The version of OpenSSL running on the remote host is affected by the following vulnerabilities :

  - The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0     and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and     other products, do not properly consider timing side-     channel attacks on a MAC check requirement during the     processing of malformed CBC padding, which allows     remote attackers to conduct distinguishing attacks and     plaintext-recovery attacks via statistical analysis of     timing data for crafted packets, aka the 'Lucky     Thirteen' issue. (CVE-2013-0169)

  - OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1     before 1.0.1d does not properly perform signature     verification for OCSP responses, which allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via an invalid key.
    (CVE-2013-0166)

The version of OpenSSL running on the remote host is affected by the following vulnerabilities :

  - The implementation of Cryptographic Message Syntax (CMS)     and PKCS #7 in OpenSSL does not properly restrict     certain oracle behavior, which makes it easier for     context-dependent attackers to decrypt data via a     Million Message Attack (MMA) adaptive chosen ciphertext     attack. (CVE-2012-0884)

  - The mime_param_cmp function in crypto/asn1/asn_mime.c in     OpenSSL allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a crafted S/MIME message, a different vulnerability     than CVE-2006-7250. (CVE-2012-1165)

  - The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c     in OpenSSL does not properly interpret integer data,     which allows remote attackers to conduct buffer overflow     attacks, and cause a denial of service (memory     corruption) or possibly have unspecified other impact,     via crafted DER data, as demonstrated by an X.509     certificate or an RSA public key. (CVE-2012-2110)

  - Multiple integer signedness errors in     crypto/buffer/buffer.c in OpenSSL allow remote attackers     to conduct buffer overflow attacks, and cause a denial     of service (memory corruption) or possibly have     unspecified other impact, via crafted DER data, as     demonstrated by an X.509 certificate or an RSA public     key. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2012-2110. (CVE-2012-2131)

  - Integer underflow in OpenSSL when TLS 1.1, TLS 1.2, or     DTLS is used with CBC encryption, allows remote     attackers to cause a denial of service (buffer over-     read) or possibly have unspecified other impact via a     crafted TLS packet that is not properly handled during a     certain explicit IV calculation. (CVE-2012-2333)

The version of OpenSSL running on the remote host is affected by the following vulnerabilities :

  - The DTLS implementation in OpenSSL before 0.9.8s and 1.x     before 1.0.0f performs a MAC check only if certain     padding is valid, which makes it easier for remote     attackers to recover plaintext via a padding oracle     attack. (CVE-2011-4108)

  - Double free vulnerability in OpenSSL 0.9.8 before     0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows     remote attackers to have an unspecified impact by     triggering failure of a policy check. (CVE-2011-4109)

  - The SSL 3.0 implementation in OpenSSL before 0.9.8s and     1.x before 1.0.0f does not properly initialize data     structures for block cipher padding, which might allow     remote attackers to obtain sensitive information by     decrypting the padding data sent by an SSL peer.
    (CVE-2011-4576)

  - The Server Gated Cryptography (SGC) implementation in     OpenSSL before 0.9.8s and 1.x before 1.0.0f does not     properly handle handshake restarts, which allows remote     attackers to cause a denial of service via unspecified     vectors. (CVE-2011-4619)

  - OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS     applications, which allows remote attackers to cause a     denial of service via unspecified vectors. NOTE: this     vulnerability exists because of an incorrect fix for     CVE-2011-4108. (CVE-2012-0050)

The version of OpenSSL running on the remote host is affected by the following vulnerabilities :

  - ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0     through 1.0.0c allows remote attackers to cause a denial     of service (crash), and possibly obtain sensitive     information in applications that use OpenSSL, via a     malformed ClientHello handshake message that triggers an     out-of-bounds memory access, aka 'OCSP stapling     vulnerability.' (CVE-2011-0014)

  - Multiple race conditions in ssl/t1_lib.c in OpenSSL     0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-     threading and internal caching are enabled on a TLS     server, might allow remote attackers to execute     arbitrary code via client data that triggers a heap-     based buffer overflow, related to (1) the TLS server     name extension and (2) elliptic curve cryptography.
    (CVE-2010-3864)

  - OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when     SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does     not properly prevent modification of the ciphersuite in     the session cache, which allows remote attackers to     force the downgrade to an unintended cipher via vectors     involving sniffing network traffic to discover a session     identifier. (CVE-2010-4180)

The version of OpenSSL running on the remote host is affected by the following vulnerabilities :

  - In TLS connections, certain incorrectly formatted     records can cause an OpenSSL client or server to crash     due to a read attempt at NULL. OpenSSL before 0.9.8m     does not check for a NULL return value from bn_wexpand     function calls in (1) crypto/bn/bn_div.c, (2)     crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4)     engines e_ubsec.c, which has an unspecified impact and     context-dependent attack vectors. (CVE-2009-3245)

  - The kssl_keytab_is_available function in ssl/kssl.c in     OpenSSL before 0.9.8n, when Kerberos is enabled but     Kerberos configuration files cannot be opened, does not     check a certain return value, which allows remote     attackers to cause a denial of service (NULL pointer     dereference and daemon crash) via SSL cipher     negotiation, as demonstrated by a chroot installation of     Dovecot or stunnel without Kerberos configuration files     inside the chroot. (CVE-2010-0433)

  - The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL     0.9.8f through 0.9.8m allows remote attackers to cause a     denial of service (crash) via a malformed record in a     TLS connection that triggers a NULL pointer dereference,     related to the minor version number. (CVE-2010-0740)

The version of OpenSSH running on the remote host is affected by a denial of service vulnerability. The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

The version of OpenSSH running on the remote host is affected by the following vulnerabilities :

  - X11 man-in-the-middle attack:
    When attempting to bind(2) to a port that has previously     been bound with SO_REUSEADDR set, most operating systems     check that either the effective user-id matches the     previous bind (common on BSD-derived systems) or that     the bind addresses do not overlap. When the     sshd_config(5) option X11UseLocalhost has been set to     'no' - an attacker may establish a more-specific bind,     which will be used in preference to sshd's wildcard     listener. (CVE-2008-3259)

  - Plaintext Recovery Attack Against SSH:
    If exploited, this attack can potentially allow an     attacker to recover up to 32 bits of plaintext from an     arbitrary block of ciphertext from a connection secured     using the SSH protocol in the standard configuration.
    If OpenSSH is used in the standard configuration, then     the attacker's success probability for recovering 32     bits of plaintext is 2^{-18}. A variant of the attack     against OpenSSH in the standard configuration can     verifiably recover 14 bits of plaintext with probability     2^{-14}. The success probability of the attack for other     implementations of SSH is not known. (CVE-2008-5161)

The version of OpenSSL running on the remote host is affected by an information disclosure vulnerability.

OpenSSL incorrectly handles memory in the TLS heartbeat extension, potentially allowing a remote attacker to read the contents of up to 64KB of server memory, potentially exposing passwords, private keys, and other sensitive data.

The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.

If ftpd is run in a 5.2 or 5.3 WPAR, a non-root user who logs in via ftp is allowed to access all files within the WPAR.

The remote host is missing AIX PTF U849877, which is related to the security of the package bos.net.tcp.client.

AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially crafted sequence of packets, an attacker could exploit this vulnerability to cause a kernel panic.

The remote host is missing AIX PTF U849815, which is related to the security of the package bos.net.tcp.client.

AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially crafted sequence of packets, an attacker could exploit this vulnerability to cause a kernel panic.

The remote host is missing AIX PTF U849490, which is related to the security of the package bos.net.tcp.client.

AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially crafted sequence of packets, an attacker could exploit this vulnerability to cause a kernel panic.

The remote host is missing AIX PTF U848205, which is related to the security of the package bos.net.tcp.client.

AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially crafted sequence of packets, an attacker could exploit this vulnerability to cause a kernel panic.

The remote host is missing AIX PTF U848193, which is related to the security of the package bos.net.tcp.client.

AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially crafted sequence of packets, an attacker could exploit this vulnerability to cause a kernel panic.

The remote host is missing AIX PTF U846741, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U846347, which is related to the security of the package bos.net.tcp.client.

Vulnerability which allows remote attackers to (1) register or (2) unregister RPC services, and consequently cause a denial of service or obtain sensitive information from interprocess communication, via crafted UDP packets containing service commands. 

Note: The ifix provided also contains the fix for CVE-2012-0194 and CVE-2011-1385 since they affect the same fileset.

See the following for CVE-2012-0194:
https://aix.software.ibm.com/aix/efixes/security/large_send_a dvisory.asc CVE-2011-1385:
https://aix.software.ibm.com/aix/efixes/security/icmp_advisor y.asc.

The remote host is missing AIX PTF U846071, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U843468, which is related to the security of the package bos.net.tcp.client.

AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially crafted sequence of packets, an attacker could exploit this vulnerability to cause a kernel panic.

The remote host is missing AIX PTF U841068, which is related to the security of the package bos.net.tcp.client.

AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially crafted sequence of packets, an attacker could exploit this vulnerability to cause a kernel panic.

The remote host is missing AIX PTF U860582, which is related to the security of the package bos.rte.control.

Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.

The remote host is missing AIX PTF U855334, which is related to the security of the package bos.net.tcp.server.

The remote host is missing AIX PTF U855283, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U854672, which is related to the security of the package bos.mp64.

The remote host is missing AIX PTF U854553, which is related to the security of the package bos.rte.methods.

The remote host is missing AIX PTF U854544, which is related to the security of the package bos.rte.filesystem.

The remote host is missing AIX PTF U854542, which is related to the security of the package devices.common.IBM.ib.rte.

ID	Name	Severity
74194	AIX 7.1 TL 1 : libodm (IV60312)	medium
74193	AIX 6.1 TL 8 : libodm (IV60311)	medium
74192	AIX 7.1 TL 3 : libodm (IV60303)	medium
74191	AIX 6.1 TL 9 : libodm (IV60299)	medium
73843	AIX 5.3 TL 12 : ptrace (IV59675)	medium
73842	AIX 6.1 TL 9 : ptrace (IV59615)	medium
73841	AIX 7.1 TL 3 : ptrace (IV59607)	medium
73840	AIX 6.1 TL 7 : ptrace (IV59045)	medium
73839	AIX 6.1 TL 8 : ptrace (IV58948)	medium
73838	AIX 7.1 TL 1 : ptrace (IV58888)	medium
73837	AIX 7.1 TL 2 : ptrace (IV58861)	medium
73735	AIX Perl Advisory : perl_advisory4.asc	high
73566	AIX OpenSSL Advisory : ssl_advisory.asc	medium
73565	AIX OpenSSH Advisory : ssh_advisory.asc	medium
73564	AIX OpenSSL Advisory : openssl_advisory6.asc	medium
73563	AIX OpenSSL Advisory : openssl_advisory5.asc	medium
73562	AIX OpenSSL Advisory : openssl_advisory4.asc	high
73561	AIX OpenSSL Advisory : openssl_advisory3.asc	high
73560	AIX OpenSSL Advisory : openssl_advisory2.asc	high
73559	AIX OpenSSL Advisory : openssl_advisory.asc	critical
73558	AIX OpenSSH Advisory : openssh_advisory2.asc	medium
73557	AIX OpenSSH Advisory: openssh_advisory.asc	low
73472	AIX OpenSSL Advisory : openssl_advisory7.doc (Heartbleed)	high
73308	AIX OpenSSH Vulnerability : openssh_advisory3.asc	medium
72927	AIX 7.1 TL 2 : wparcre (IV51421)	medium
72926	AIX 7.1 TL 1 : wparcre (IV51420)	medium
72848	AIX 6.1 TL 6 : bos.net.tcp.client (U849877)	high
72847	AIX 6.1 TL 5 : bos.net.tcp.client (U849815)	high
72846	AIX 7.1 TL 1 : bos.net.tcp.client (U849490)	high
72845	AIX 7.1 : bos.net.tcp.client (U848205)	high
72844	AIX 6.1 TL 7 : bos.net.tcp.client (U848193)	high
72843	AIX 7.1 TL 1 : bos.net.tcp.client (U846741)	high
72842	AIX 5.3 TL 12 : bos.net.tcp.client (U846347)	high
72841	AIX 6.1 TL 7 : bos.net.tcp.client (U846071)	high
72840	AIX 7.1 TL 1 : bos.net.tcp.client (U843468)	high
72839	AIX 6.1 TL 7 : bos.net.tcp.client (U841068)	high
72609	AIX 6.1 TL 7 : bos.rte.control (U860582)	high
72288	AIX 7.1 TL 3 : xorg (IV53246)	medium
72287	AIX 6.1 TL 9 : xorg (IV52978)	medium
72070	AIX 5.3 TL 12 : xorg (IV53331)	medium
72069	AIX 7.1 TL 2 : xorg (IV52186)	medium
72068	AIX 7.1 TL 1 : xorg (IV52185)	medium
72067	AIX 6.1 TL 8 : xorg (IV52184)	medium
72066	AIX 6.1 TL 7 : xorg (IV52181)	medium
71165	AIX 6.1 TL 9 : bos.net.tcp.server (U855334)	high
71164	AIX 6.1 TL 9 : bos.net.tcp.client (U855283)	high
71163	AIX 6.1 TL 9 : bos.mp64 (U854672)	medium
71162	AIX 6.1 TL 9 : bos.rte.methods (U854553)	high
71161	AIX 6.1 TL 9 : bos.rte.filesystem (U854544)	low
71160	AIX 6.1 TL 9 : devices.common.IBM.ib.rte (U854542)	high

Detections

Analytics

AIX Local Security Checks Family for Nessus

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

high

high

high

critical

medium

low

high

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

high

high

medium

high

low

high