The remote host is missing AIX PTF U804030, which is related to the security of the package bos.rte.SRC.

The remote host is missing AIX PTF U803849, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U802811, which is related to the security of the package devices.chrp.base.diag.

The remote host is missing AIX PTF U802798, which is related to the security of the package bos.rte.shell.

The remote host is missing AIX PTF U802796, which is related to the security of the package printers.rte.

The remote host is missing AIX PTF U802795, which is related to the security of the package bos.acct.

The remote host is missing AIX PTF U802791, which is related to the security of the package bos.diag.util.

The remote host is missing AIX PTF U802761, which is related to the security of the package bos.rte.control.

The remote host is missing AIX PTF U802735, which is related to the security of the package bos.svprint.rte.

The remote host is missing AIX PTF U800640, which is related to the security of the package bos.rte.filesystem.

The remote host is missing AIX PTF U800638, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U800632, which is related to the security of the package bos.diag.rte.

The remote host is missing AIX PTF U800591, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U499696, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U497412, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U487052, which is related to the security of the package bos.rte.lvm.

The remote host is missing AIX PTF U477978, which is related to the security of the package bos.rte.console.

The remote host is missing AIX PTF U477911, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U477557, which is related to the security of the package bos.rte.SRC.

The remote host is missing AIX PTF U477539, which is related to the security of the package bos.diag.rte.

The remote host is missing AIX PTF U477521, which is related to the security of the package devices.chrp.base.rte.

The remote host is missing AIX PTF U477512, which is related to the security of the package bos.rte.filesystem.

The root owned files can be read by non-root users only when the directory permissions are set allowed for non-root users. For example, a non-root user won't be able to read anything under /etc/security, but can read files like /etc/rc.wpars under ftp.

There is a buffer overflow vulnerability in the qosmod command. A locally authenticated attacker can exploit this vulnerability if they have they have been assigned the aix.network.config.no role-based access control authorization.

The successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with the innate privileges of the qosmod command.

The following executable is vulnerable :

/usr/sbin/qosmod.

There is a buffer overflow vulnerability in the qoslist command. A locally authenticated attacker can exploit this vulnerability if they have they have been assigned the aix.network.status or aix.network.config.no role-based access control authorizations.

The successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with the innate privileges of the qoslist command.

The following executable is vulnerable :

/usr/sbin/qoslist.

There is a buffer overflow vulnerability in the calendar daemon library libcsa.a. A remote attacker can exploit this vulnerability when the rpc.cmsd calendar daemon is enabled in /etc/inetd.conf.

The successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code as the root user.

The following libraries and executables are vulnerable :

/usr/dt/bin/rpc.cmsd /usr/dt/lib/libcsa.a.

There is a an error in the handling of the _LIB_INIT_DBG and
_LIB_INIT_DBG_FILE environment variables in a debugging component of the XL C++ runtime library. A local user can exploit this error when executing setuid root programs linked with the XL C++ runtime library, and thereby create arbirtrary, world writeable files owned by root.

The successful exploitation of this vulnerability allows a local user to create arbitrary files and execute arbitrary code as the root user.

Note that in AIX 6.1 the debugging component moved from libC.a to libc.a. This means that the fix is delivered by updating the XL C++ runtime on AIX 5.3 and earlier, and by updating the bos.rte.libc fileset on AIX 6.1.

The following libraries are vulnerable :

AIX 5.3 and earlier: /usr/lpp/xlC/lib/libC.a

AIX 6.1: /usr/ccs/lib/libc.a /usr/ccs/lib/libp/libc.a.

There is a buffer overflow vulnerability in the ToolTalk library libtt.a. A remote attacker can exploit this vulnerability when the rpc.ttdbserver is enabled in /etc/inetd.conf. 

The successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code as the root user.

The following libraries and executables are vulnerable :

/usr/dt/lib/libtt.a /usr/dt/bin/rpc.ttdbserver.

ID	Name	Severity
65278	AIX 5.3 TL 4 : bos.rte.SRC (U804030)	high
65277	AIX 5.2 TL 10 : bos.net.tcp.client (U803849)	medium
65276	AIX 5.3 TL 8 : devices.chrp.base.diag (U802811)	high
65275	AIX 5.3 TL 8 : bos.rte.shell (U802798)	high
65274	AIX 5.3 TL 8 : printers.rte (U802796)	high
65273	AIX 5.3 TL 8 : bos.acct (U802795)	high
65272	AIX 5.3 TL 8 : bos.diag.util (U802791)	high
65271	AIX 5.3 TL 7 : bos.rte.control (U802761)	high
65270	AIX 5.3 TL 7 : bos.svprint.rte (U802735)	high
65269	AIX 5.3 TL 4 : bos.rte.filesystem (U800640)	high
65268	AIX 5.3 TL 4 : bos.net.tcp.client (U800638)	critical
65267	AIX 5.3 TL 4 : bos.diag.rte (U800632)	high
65266	AIX 5.3 TL 6 : bos.net.tcp.client (U800591)	medium
65265	AIX 5.2 TL 8 : bos.net.tcp.client (U499696)	critical
65264	AIX 5.3 TL 5 / 5.3 TL 4 : bos.net.tcp.client (U497412)	medium
65263	AIX 5.3 TL 5 : bos.rte.lvm (U487052)	high
65262	AIX 5.2 TL 9 : bos.rte.console (U477978)	high
65261	AIX 5.2 TL 9 / 5.2 TL 8 : bos.net.tcp.client (U477911)	medium
65260	AIX 5.2 TL 8 : bos.rte.SRC (U477557)	high
65259	AIX 5.2 TL 8 : bos.diag.rte (U477539)	high
65258	AIX 5.2 TL 7 / 5.2 TL 8 : devices.chrp.base.rte (U477521)	medium
65257	AIX 5.2 TL 8 : bos.rte.filesystem (U477512)	high
64510	AIX 7.1 TL 2 : ftp (IV30669)	medium
64509	AIX 6.1 TL 8 : ftp (IV28651)	medium
64360	AIX 6.1 TL 1 : qosmod (IZ71870)	high
64359	AIX 6.1 TL 1 : qoslist (IZ71869)	high
64358	AIX 6.1 TL 2 : qosmod (IZ71627)	high
64357	AIX 6.1 TL 2 : qoslist (IZ71590)	high
64356	AIX 6.1 TL 3 : qosmod (IZ71555)	high
64355	AIX 6.1 TL 3 : qoslist (IZ71554)	high
64354	AIX 6.1 TL 4 : qosmod (IZ68231)	high
64353	AIX 6.1 TL 4 : qoslist (IZ68194)	high
64352	AIX 6.1 TL 3 : cmsd (IZ62572)	critical
64351	AIX 6.1 TL 2 : cmsd (IZ62571)	critical
64350	AIX 6.1 TL 1 : cmsd (IZ62570)	critical
64349	AIX 6.1 TL 0 : cmsd (IZ62569)	critical
64348	AIX 5.3 TL 8 : cmsd (IZ62237)	critical
64347	AIX 5.3 TL 10 : cmsd (IZ62123)	critical
64346	AIX 5.3 TL 9 : cmsd (IZ61717)	critical
64345	AIX 5.3 TL 7 : cmsd (IZ61628)	critical
64344	AIX 6.1 TL 3 : libC (IZ56206)	high
64343	AIX 6.1 TL 2 : libC (IZ56205)	high
64342	AIX 6.1 TL 1 : libC (IZ56204)	high
64341	AIX 6.1 TL 0 : libC (IZ56203)	high
64340	AIX 6.1 TL 3 : libtt (IZ52851)	high
64339	AIX 6.1 TL 2 : libtt (IZ52850)	high
64338	AIX 6.1 TL 1 : libtt (IZ52849)	high
64337	AIX 6.1 TL 0 : libtt (IZ52848)	high
64336	AIX 5.3 TL 9 : libtt (IZ52846)	high
64335	AIX 5.3 TL 8 : libtt (IZ52845)	high

Detections

Analytics

AIX Local Security Checks Family for Nessus

high

medium

high

high

high

high

high

high

high

high

critical

high

medium

critical

medium

high

high

medium

high

high

medium

high

medium

medium

high

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high