The version of AIX installed on the remote host is prior to APAR IJ35826. It is, therefore, affected by a vulnerability as referenced in the IJ35826 advisory.

  - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     mount command which could lead to code execution. IBM X-Force ID: 212952. (CVE-2021-38990)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ35078. It is, therefore, affected by a vulnerability as referenced in the IJ35078 advisory.

  - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS     to expose sensitive information. IBM X-Force ID: 206085. (CVE-2021-29861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ33560. It is, therefore, affected by a vulnerability as referenced in the IJ33560 advisory.

  - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     libc.a library to expose sensitive information. IBM X-Force ID: 206084. (CVE-2021-29860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ35673. It is, therefore, affected by a vulnerability as referenced in the IJ35673 advisory.

  - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     libc.a library to expose sensitive information. IBM X-Force ID: 206084. (CVE-2021-29860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ35780. It is, therefore, affected by a vulnerability as referenced in the IJ35780 advisory.

  - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS     to expose sensitive information. IBM X-Force ID: 206085. (CVE-2021-29861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ35211. It is, therefore, affected by a vulnerability as referenced in the IJ35211 advisory.

  - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS     to expose sensitive information. IBM X-Force ID: 206085. (CVE-2021-29861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ35226. It is, therefore, affected by a vulnerability as referenced in the IJ35226 advisory.

  - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS     to expose sensitive information. IBM X-Force ID: 206085. (CVE-2021-29861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ34081. It is, therefore, affected by a vulnerability as referenced in the IJ34081 advisory.

  - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     libc.a library to expose sensitive information. IBM X-Force ID: 206084. (CVE-2021-29860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ34512. It is, therefore, affected by a vulnerability as referenced in the IJ34512 advisory.

  - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     libc.a library to expose sensitive information. IBM X-Force ID: 206084. (CVE-2021-29860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29727 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29727 IBM AIX could allow a local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM AIX could allow a non-privileged local user to exploit a vulnerability in the kernel to gain root privileges. IBM AIX could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service.

The version of OpenSSL installed on the remote AIX host is affected by a denial of service vulnerability.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29741 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29741 IBM AIX could allow a local user to exploit a vulnerability in Korn Shell (ksh) to gain root privileges.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25215 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25215 ISC BIND is vulnerable to a denial of service, caused by an assertion failure while answering queries for DNAME records. By sending a query for DNAME records, an attacker could exploit this vulnerability to trigger a failed assertion check and terminate the named process.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29693 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29693 IBM AIX could allow a local user with elevated privileges to exploit a vulnerability in the lpd daemon.

IBM AIX could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive information or cause a denial of service. (CVE-2021-29706)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4887 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4887 The AIX gencore user command may be exploited to create arbitrary files in any directory.

The AIX gencore user command may be exploited to create arbitrary files in any directory. (CVE-2020-4887)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8622 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8622 ISC BIND is vulnerable to a denial of service, caused by an assertion failure when attempting to verify a truncated response to a TSIG-signed request. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause the server to exit.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Perl before 5.30.3 has an integer overflow related to mishandling of a 'PL_regkind[OP(n)] == NOTHING' situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4788 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4788 IBM Power9 processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances.

IBM Power9 processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. (CVE-2020-4788)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8616 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8616 ISC BIND is vulnerable to a denial of service, caused by the failure to limit the number of fetches performed when processing referrals. By using specially crafted referrals, a remote attacker could exploit this vulnerability to cause the recursing server to issue a very large number of fetches in an attempt to process the referral. ISC BIND is vulnerable to a denial of service, caused by a logic error in code which checks TSIG validity. A remote attacker could exploit this vulnerability to trigger an assertion failure in tsig.c.

The remote AIX host has a version of OpenSSH installed that is affected by a vulnerability that allows a remote attacker to obtain sensitive information, caused by different responses to valid and invalid authentication attempts. By sending a specially crafted request, an attacker could exploit this vulnerability to enumerate valid usernames.

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :

  - OpenSSH is vulnerable to a denial of service, caused by     an error in the kex_input_kexinit() function. By     sending specially crafted data during the key exchange     process, a remote attacker could exploit this     vulnerability to consume all available memory resources.
    (CVE-2016-8858)

  - OpenSSH could allow a remote authenticated attacker to     execute arbitrary code on the system, caused by the     loading of a specially crafted PKCS#11 module across a     forwarded agent channel. An attacker could exploit this     vulnerability to write files or execute arbitrary code     on the system. (CVE-2016-10009)

  - OpenSSH could allow a local authenticated attacker to     obtain sensitive information, caused by a privilege     separation flaw. An attacker could exploit this     vulnerability to obtain host private key material and     other sensitive information. (CVE-2016-10011)

  - OpenSSH could allow a local attacker to gain elevated     privileges on the system, caused by improper bounds     checking in the shared memory manager. An attacker     could exploit this vulnerability to gain elevated     privileges on the system. (CVE-2016-10012)

The version of OpenSSH installed on the remote AIX host is affected by a vulnerability in the process_open function of sftp-server.c in OpenSSH in that it does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14467 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14467 The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP). The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print(). The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs(). The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2(). tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2). The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print(). tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).
Tcpdump is vulnerable to a buffer overflow, caused by improper bounds checking by the lmp_print_data_link_subobjs function in print-lmp.c.
By sending specially-crafted data, a remote attacker could overflow a buffer and cause the application to crash. The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert(). The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print(). The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print(). The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART). The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print(). The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr(). The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print(). The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN. The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion. The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI). lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks. The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file(). The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix(). The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option(). The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield. The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion. The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c. tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c.

ID	Name	Severity
156553	AIX (IJ35826)	high
155459	AIX (IJ35078)	medium
155458	AIX (IJ33560)	medium
155457	AIX (IJ35673)	medium
155456	AIX (IJ35780)	medium
155455	AIX (IJ35211)	medium
155454	AIX (IJ35226)	medium
155453	AIX (IJ34081)	medium
155452	AIX (IJ34512)	medium
152858	AIX 7.2 TL 4 : kernel (IJ32630)	high
152856	AIX 7.2 TL 3 : kernel (IJ32629)	high
152855	AIX 7.2 TL 5 : kernel (IJ32631)	high
152854	AIX 7.1 TL 5 : kernel (IJ33318)	high
152700	AIX OpenSSL Advisory : openssl_advisory28.asc	high
152175	AIX 7.2 TL 5 : ksh (IJ30557)	high
152174	AIX 7.2 TL 4 : ksh (IJ31614)	high
152173	AIX 7.1 TL 5 : ksh (IJ31606)	high
152172	AIX 7.2 TL 3 : ksh (IJ32285)	high
152152	AIX 7.2 TL 4 : bind (IJ33278)	high
152151	AIX 7.2 TL 3 : bind (IJ33277)	high
152149	AIX 7.2 TL 5 : bind (IJ33279)	high
152148	AIX 7.1 TL 5 : bind (IJ33276)	high
151051	AIX 7.2 TL 3 : lpd (IJ30799)	medium
151050	AIX 7.1 TL 5 : lpd (IJ30372)	medium
151030	AIX 7.2 TL 4 : lpd (IJ30800)	medium
151027	AIX 7.2 TL 5 : lpd (IJ30447)	medium
150804	AIX 7.1 TL 5 : trace (IJ32940)	medium
145195	AIX 7.2 TL 4 : gencore (IJ28827)	medium
145124	AIX 7.2 TL 5 : gencore (IJ28828)	medium
145114	AIX 7.2 TL 3 : gencore (IJ28826)	medium
145097	AIX 7.1 TL 5 : gencore (IJ28825)	medium
144502	AIX 7.1 TL 5 : bind (IJ29230)	medium
144498	AIX 7.2 TL 4 : bind (IJ29231)	medium
144496	AIX 7.2 TL 3 : bind (IJ29229)	medium
144485	AIX 7.2 TL 5 : bind (IJ29232)	medium
144320	AIX 7.2 TL 3 : perl (IJ26986)	high
144314	AIX 7.1 TL 5 : perl (IJ26985)	high
143147	AIX 7.2 TL 4 : power9 (IJ28227)	medium
143142	AIX 7.1 TL 5 : power9 (IJ28229)	medium
143136	AIX 7.2 TL 5 : power9 (IJ28226)	medium
143131	AIX 7.2 TL 3 : power9 (IJ28228)	medium
139755	AIX 7.2 TL 4 : bind (IJ25927)	high
139754	AIX 7.2 TL 3 : bind (IJ25926)	high
139753	AIX 7.2 TL 2 : bind (IJ25925)	high
139752	AIX 7.1 TL 5 : bind (IJ25924)	high
136325	AIX OpenSSH Advisory : openssh_advisory12.asc	medium
136324	AIX OpenSSH Advisory : openssh_advisory10.asc	high
136323	AIX OpenSSH Advisory : openssh_advisory11.asc	medium
132733	AIX 7.2 TL 4 : tcpdump (IJ20786)	critical
132732	AIX 7.2 TL 3 : tcpdump (IJ20785)	critical

Detections

Analytics

AIX Local Security Checks Family for Nessus

high

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

high

high

high

high

medium

high

medium

critical

critical